title: Error when trying to get token using Managed Service Identity in a multi-container azure web app service
body: <p>We have the following scenario:</p>
  
  <p><strong>Current working setup</strong></p>
  
  <ol>
  <li>Web API project using a single DockerFile</li>
  <li>A release pipe line with an 'Azure App Service deploy' task.</li>
  </ol>
  
  <p><strong>Proposed new setup</strong></p>
  
  <ol>
  <li>Web API project using multi container Docker Compose file</li>
  <li>A release pipe line with an 'Azure Web App for Containers' task.</li>
  </ol>
  
  <p>Upon deploying the new setup we receive the below error message:</p>
  
  <pre><code>ERROR - multi-container unit was not started successfully
  
  Unhandled exception. System.AggregateException: One or more errors occurred. 
  (Parameters: Connection String: XXX, Resource: https://vault.azure.net, Authority: 
  https://login.windows.net/xxxxx. Exception Message: 
  Tried to get token using Managed Service Identity. 
  Access token could not be acquired. Connection refused)
  </code></pre>
  
  <p>The exception thrown is because it can't connect to Azure MSI (Managed Service Identity). It does this to obtain a token before connecting to key vault.</p>
  
  <p>I have tried the following based upon some research and solutions others have found:</p>
  
  <ol>
  <li>Connecting with <code>"RunAs=App"</code> (this seems to be the default parameter-less constructor anyway)</li>
  <li>Building up the connection string myself manually by pulling the <code>"MSI_SECRET"</code> environment variable from the machine. This is always blank.</li>
  <li>Restarting MSI.</li>
  <li>Upgrading and downgrading <code>AppAuthentication</code> package</li>
  </ol>
  
  <p>MSI appears to be configured correctly as it works perfectly with our current working setup so we can rule that out.
  It's worth noting that this is System assigned identity not a user assigned one.</p>
  
  <p>The documentation that states which services support managed identites only mentions 'Azure Container Instances' not 'Azure Managed Container Instances' and that is for Linux/Preview too so that it could be not supported.</p>
  
  <p><a href="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/services-support-managed-identities#azure-container-instances" rel="nofollow noreferrer">Services that support managed identities for Azure resources</a></p>
  
  <p>We've spent a considerable amount of time getting to this point with the configuration and deployment and it would be great if we could resolve this last issue.</p>
  
  <p>Any help appreciated. </p>