title: KeyVaultErrorException: Operation returned an invalid status code 'Forbidden'
body: <p>I'm trying to set up my web app, hosted in Azure to read settings from Azure KeyVault.</p>
  
  <p>I've been following this guide: <a href="https://anthonychu.ca/post/secrets-aspnet-core-key-vault-msi/" rel="noreferrer">https://anthonychu.ca/post/secrets-aspnet-core-key-vault-msi/</a></p>
  
  <p>The example shows how to access app settings from KeyVault with the configuration:</p>
  
  <pre><code>public static IWebHost BuildWebHost(string[] args) =&gt;
      WebHost.CreateDefaultBuilder(args)
       .ConfigureAppConfiguration((ctx, builder) =&gt;
       {
           var keyVaultEndpoint = Environment.GetEnvironmentVariable("KEYVAULT_ENDPOINT");
           if (!string.IsNullOrEmpty(keyVaultEndpoint))
           {
               var azureServiceTokenProvider = new AzureServiceTokenProvider();
               var keyVaultClient = new KeyVaultClient(
                   new KeyVaultClient.AuthenticationCallback(
                       azureServiceTokenProvider.KeyVaultTokenCallback));
               builder.AddAzureKeyVault(
                   keyVaultEndpoint, keyVaultClient, new DefaultKeyVaultSecretManager());
           }
       })
      .UseApplicationInsights()
      .UseStartup&lt;Startup&gt;()
      .Build();
  </code></pre>
  
  <p>I've added the KEYVAULT_ENDPOINT environment variable to the application settings. I've enabled MSI on the app service, and I've authorized my Azure User, and my application, from the Key Vault Access Policies:</p>
  
  <p><a href="https://i.stack.imgur.com/iUv3x.png" rel="noreferrer"><img src="https://i.stack.imgur.com/iUv3x.png" alt="enter image description here"></a></p>
  
  <p>With Get and List Operations:</p>
  
  <p><a href="https://i.stack.imgur.com/47a1K.png" rel="noreferrer"><img src="https://i.stack.imgur.com/47a1K.png" alt="enter image description here"></a> </p>
  
  <p>And I've added the secret to key vault. Running locally, I can access the secret.</p>
  
  <p>But my ASP .NET Core site fails on startup with this in the stdout logs:</p>
  
  <pre><code>Unhandled Exception: Microsoft.Azure.KeyVault.Models.KeyVaultErrorException: Operation returned an invalid status code 'Forbidden'
     at Microsoft.Azure.KeyVault.KeyVaultClient.GetSecretsWithHttpMessagesAsync(String vaultBaseUrl, Nullable`1 maxresults, Dictionary`2 customHeaders, CancellationToken cancellationToken)
     at Microsoft.Azure.KeyVault.KeyVaultClientExtensions.GetSecretsAsync(IKeyVaultClient operations, String vaultBaseUrl, Nullable`1 maxresults, CancellationToken cancellationToken)
     at Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.LoadAsync()
     at Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.Load()
     at Microsoft.Extensions.Configuration.ConfigurationRoot..ctor(IList`1 providers)
     at Microsoft.Extensions.Configuration.ConfigurationBuilder.Build()
     at Microsoft.AspNetCore.Hosting.WebHostBuilder.BuildCommonServices(AggregateException&amp; hostingStartupErrors)
     at Microsoft.AspNetCore.Hosting.WebHostBuilder.Build()
     at Blog.Program.BuildWebHost(String[] args) in D:\a\1\s\[csproj name]\Program.cs:line 22
     at [csproj name].Program.Main(String[] args) in D:\a\1\s\[csproj name]\Program.cs:line 16
  </code></pre>
  
  <p>I've checked that MSI_ENDPOINT and MSI_SECRET environment variables exist by calling SET from the debug console.  <a href="https://i.stack.imgur.com/km5B6.png" rel="noreferrer"><img src="https://i.stack.imgur.com/km5B6.png" alt="enter image description here"></a> </p>
  
  <p>I can also see the KEYVAULT_ENDPOINT variable.</p>
  
  <p>Any suggestions what could be going wrong or on what to try next? Since it works locally it must be an authentication issue, but I believe it's authenticating locally with my azure User that I've authorized in key vault, rather than as the Azure App Service. </p>