title: Azure App Config, Key Vault & Managed Service Identity (.NET Core 3.1)
body: <p>I have a simple app service set up to use/test Azure App Configuration</p>
  
  <ul>
  <li>The Azure App Config contains 2 non-KeyVault entries, and 1 entry which is a Key Vault reference</li>
  <li>The Key Vault is set up with the proper Access Policy, allowing Get/List of Secrets to the Managed Service Identity of the Azure App Config</li>
  </ul>
  
  <p>I've followed the <a href="https://docs.microsoft.com/en-us/azure/azure-app-configuration/quickstart-aspnet-core-app?tabs=core3x" rel="nofollow noreferrer">sample application</a>, so the CreateHostBuilder looks like:</p>
  
  <pre><code>public static IHostBuilder CreateHostBuilder(string[] args) =&gt;
  Host.CreateDefaultBuilder(args)
  .ConfigureWebHostDefaults(webBuilder =&gt;
  webBuilder.ConfigureAppConfiguration((hostingContext, config) =&gt;
  {
      var settings = config.Build();
      config.AddAzureAppConfiguration(settings["ConnectionStrings:AppConfig"]);
  })
  .UseStartup&lt;Startup&gt;());
  </code></pre>
  
  <p>When deploying/running the app, the behavior is successful when there are no Azure App Config entries which point to KeyVault.</p>
  
  <p>When I add an entry in Azure App Config which points to KeyVault, the app will not start (HTTP Error 500.30 - ANCM In-Process Start Failure), the logs are showing this exception:</p>
  
  <p><em>Exception Info: Microsoft.Extensions.Configuration.AzureAppConfiguration.KeyVaultReferenceException: No key vault credential configured and no matching secret client could be found.. ErrorCode:, Key:TestConnectionString, Label:, Etag:6ezsqW96CsAet7Ym5H4DedsLTkI, SecretIdentifier:<a href="https://testkeyvault.vault.azure.net/secrets/TestSecret" rel="nofollow noreferrer">https://testkeyvault.vault.azure.net/secrets/TestSecret</a>
   ---&gt; System.UnauthorizedAccessException: No key vault credential configured and no matching secret client could be found.</em></p>
  
  <p>It seems obvious that something isn't secured correctly, but I've checked many times and the Key Vault has an access policy granting Get/List of Secrets to the Azure App Config identity.</p>
  
  <p>I've also tried the ConfigureKeyVault option in the host builder, i.e. </p>
  
  <pre><code>public static IHostBuilder CreateHostBuilder(string[] args) =&gt;
      Host.CreateDefaultBuilder(args)
      .ConfigureWebHostDefaults(webBuilder =&gt;
      webBuilder.ConfigureAppConfiguration((hostingContext, config) =&gt;
      {
          var settings = config.Build();
  
          config.AddAzureAppConfiguration(options =&gt;
          {
              options.Connect(settings["ConnectionStrings:AppConfig"])
                      .ConfigureKeyVault(kv =&gt;
                      {
                          kv.SetCredential(new DefaultAzureCredential());
                      });
          });
      })
      .UseStartup&lt;Startup&gt;());
  </code></pre>
  
  <p>Is the Access Policy on the Key Vault granting Get/List of Secrets to the Azure App Config identity all that needs to be done, or have I missed something?  (I've also tried granting an Access Policy to the app service, no luck).</p>