I've implemented a solution using Azure Key Vault for encryption keys. I've followed the recommendations from the docs at <https://learn.microsoft.com/en-us/azure/app-service/app-service-managed-service-identity> for how to authenticate my App Service to the Azure Key Vault using Managed Service Identity. My app service is an asp.net core 2.1 application.

This is working when I publish the app service to my Azure subscription so I'm confident that the implementation is correct. The problem is with running the code locally and attempting to connect to the Azure Key Vault using MSI doesn't seem to be working for me as advertised.

I'm running Visual Studio 2017 Version 15.8.5. My corporate identity with Azure Active Directory is how I'm logged into VS (i.e. sbraswell@*myemployer.com*). However, the Azure subscription I'm using is part of my MSDN partner benefits and is associated with my Microsoft Account (MSA) (i.e. *something*@hotmail.com). I've granted my corporate AAD identity 'Owner' Role permissions to my subscription. I'm able to log in to the Azure portal as my corporate identity and access all aspects of my Azure subscription associated with my MSA account.

The following code is not throwing an exception when getting an access token to Azure Key Vault:

```
var tokenProvider = new 
Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider();
var token = await tokenProvider.GetAccessTokenAsync(resource);
return token;

```

This code is throwing an exception when I attempt to resolve the specific encryption key from the vault:

```
var keyEncryptionKey = await cloudResolver.ResolveKeyAsync(keyId, CancellationToken.None)

```

The exception thrown is:

```
Microsoft.Azure.KeyVault.Models.KeyVaultErrorException: Operation returned an invalid status code 'Unauthorized'
   at Microsoft.Azure.KeyVault.KeyVaultClient.GetKeyWithHttpMessagesAsync(String vaultBaseUrl, String keyName, String keyVersion, Dictionary`2 customHeaders, CancellationToken cancellationToken)
   at Microsoft.Azure.KeyVault.KeyVaultClientExtensions.GetKeyAsync(IKeyVaultClient operations, String keyIdentifier, CancellationToken cancellationToken)

```

I'd like to be able to deploy the solution using MSI for authentication so we don't have to create an Active Directory Application that acts as the intermediary between the App Service and the Key Vault. We end up having to put the App ID and App Secret into our app service configuration and with MSI we avoid having to manage those two extra bits of sensitive data.

Thanks in advance for any suggestions you have.

**UPDATE**

I've confirmed that if I use a Key Vault that is part of a subscription associated with my corporate AAD account, the MSI authentication from VS works correctly without an exception. There must be something wrong with my configuration. Does anyone else have this issue with their Microsoft Partner Network Visual Studio Enterprise Subscription Azure benefits? Identity management with MS is a MesS :(