title: Azure App Service Container Managed Identity Key Vault in.NET Core C#
body: <p>I have a C# app running in a linux docker container in Azure App Services that gets it's configuration information from Azure Key vault.</p>
  
  <p>In the past we did this:</p>
  
  <pre><code>config.AddAzureKeyVault(builtConfig["Azure:Auth:Vault"],
      builtConfig["Azure:Auth:ClientId"], builtConfig["Azure:Auth:ClientSecret"]);
  </code></pre>
  
  <p>We've been trying to, instead, use managed identity.  So I:</p>
  
  <ol>
  <li>When to identity on the app service and clicked enable on the system identity and hit save.</li>
  <li>Went into the azure keyvault and added the system identity for the app service with get, list, decrypt and unwrap on the 3 areas for it like we do for users using VS.net authentication for this.</li>
  <li><p>Added the AppAuthenication library from nuget.</p></li>
  <li><p>Updated my code like this:</p>
  
  <pre><code>var azureServiceTokenProvider = new AzureServiceTokenProvider();
  var keyVaultClient = new KeyVaultClient(
      new KeyVaultClient.AuthenticationCallback(
          azureServiceTokenProvider.KeyVaultTokenCallback));
  config.AddAzureKeyVault(builtConfig["Azure:Auth:Vault"], keyVaultClient, 
      new DefaultKeyVaultSecretManager());
  </code></pre></li>
  </ol>
  
  <p>But when we put this into Azure App Services by updating the container, it just hangs trying to start the app.  Nothing happens and eventually it times out.</p>
  
  <p>I can find lots of documentation for direct app services, but nothing different for containers. It appears to say that it's supported however.</p>
  
  <p>What am I missing for making this work for linux containers in App Services?</p>
  
  <p>Even turning on managed identity causes the container to never respond to ping checks let alone start properly.</p>