title: I'm having problems authenticating with Managed Service Identity to an Azure App Service secured with AAD
body: <p>I am trying to use a HttpClient to connect to a web service hosted in an Azure App Service that is secured with AAD using Managed Service Identity.
  When trying to connect from client code using a AzureServiceTokenProvider I'm getting a AzureServiceTokenProviderException when trying to get a token</p>
  
  <p>Base setup:</p>
  
  <p>AAD tenant AADX.onmicrosoft.com
  Contains an Application Registration for the target app service mytest. It has Application ID XXXXXXXX-XXXX-49e6-a806-5440b00282b1 and according to the manifest it has identifier URL "<a href="https://AADX.onmicrosoft.com/mytest" rel="nofollow noreferrer">https://AADX.onmicrosoft.com/mytest</a>"</p>
  
  <p>An App service "mytest" has been created in a subscription under this AAD so with URL <a href="https://mytest.azurewebsites.net" rel="nofollow noreferrer">https://mytest.azurewebsites.net</a></p>
  
  <p>In authentication setting for the app service "App Service Authentication" is on. Action to take when request is not authenticated is set to "Log in with Azure Active Directory". AAD authentication provider is configured with express settings, pointing to AADX and using the "mytest" application.</p>
  
  <p>We have resources that need to talk to this App service both inside our azure tenant and outside it. The resources outside the azure tenant route through API management to the specific parts of the API they need, using Subscription keys in a controlled manner.</p>
  
  <p>There are app services, and desktop apps hosted in RemoteApp that need to access the full service hosted under the app. Managed identity is switched on for all infrastructure within the tenant that needs to connect. </p>
  
  <p>When I use the code below I get an exception regarding the failure to get a token. If I change the requested resource to "<a href="https://login.microsoftonline.com/" rel="nofollow noreferrer">https://login.microsoftonline.com/</a>" then I can get a token, though not a correct one (it actually picks up my MS online login not the account selected in options)</p>
  
  <pre class="lang-cs prettyprint-override"><code>        private static HttpClient ConnectToClient()
          {
              String BaseUrl = "https://mytest.azurewebsites.net/";
              String AdResource = "https://AADX.onmicrosoft.com/mytest";
  
              AzureServiceTokenProvider TokenProvider = new AzureServiceTokenProvider();
              String Token = TokenProvider.GetAccessTokenAsync(AdResource).Result;
  
              HttpClient Client = new HttpClient()
              {
                  BaseAddress = new Uri(BaseUrl)
              };
  
              Client.DefaultRequestHeaders.Accept.Clear();
              Client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
  
  
              Client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", Token);
  
              return Client;
          }
  
          private static String GetContent()
          {
              String Output = String.Empty;
  
              using (HttpClient Client = ConnectToClient())
              {
                  HttpResponseMessage ResponseMessage = Client.GetAsync("api/Test/").Result;
  
                  if (ResponseMessage.IsSuccessStatusCode)
                  {
                      Output = ResponseMessage.Content.ReadAsStringAsync().Result;
                  }
              }
  
              return Output;
          }
  </code></pre>
  
  <p>I would expect Token to be returned as a valid value to be used as a bearer token. Instead at the point GetAccessTokenAsync is called the following exception is thrown:</p>
  
  <p>System.AggregateException
    HResult=0x80131500
    Message=One or more errors occurred. (Parameters: Connection String: [No connection string specified], Resource: <a href="https://AADX.onmicrosoft.com/mytest" rel="nofollow noreferrer">https://AADX.onmicrosoft.com/mytest</a>, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.</p>
  
  <p>Parameters: Connection String: [No connection string specified], Resource: <a href="https://AADX.onmicrosoft.com/mytest" rel="nofollow noreferrer">https://AADX.onmicrosoft.com/mytest</a>, Authority: . Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup.
  Parameters: Connection String: [No connection string specified], Resource: <a href="https://AADX.onmicrosoft.com/mytest" rel="nofollow noreferrer">https://AADX.onmicrosoft.com/mytest</a>, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. 
  Exception for Visual Studio token provider Microsoft.Asal.TokenService.exe : TS003: Error, TS004: Unable to get access token.  'Failed to refresh access token'</p>