{"record":{"id":"396f145c3f2eda64","repo":"microsoft/aspire","slug":"cannot-create-a-microsoft-foundry-project-connection-to-an-396f14","errorCode":null,"errorMessage":"Cannot create a Microsoft Foundry project connection to an emulator Key Vault.","messagePattern":"Cannot create a Microsoft Foundry project connection to an emulator Key Vault\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Foundry/Project/ConnectionBuilderExtensions.cs","lineNumber":311,"sourceCode":"\n    /// <summary>\n    /// Adds a Key Vault connection to the Microsoft Foundry project.\n    /// </summary>\n    /// <remarks>\n    /// This connection allows the Microsoft Foundry project to store secrets for various other connections.\n    /// As such, we recommend adding this connection *before* any others, so that those connections\n    /// can leverage the Key Vault connection for secret storage.\n    /// </remarks>\n    [AspireExport(\"addKeyVaultConnection\")]\n    public static IResourceBuilder<AzureCognitiveServicesProjectConnectionResource> AddConnection(\n        this IResourceBuilder<AzureCognitiveServicesProjectResource> builder,\n        IResourceBuilder<AzureKeyVaultResource> keyVault)\n    {\n        ArgumentNullException.ThrowIfNull(builder);\n        ArgumentNullException.ThrowIfNull(keyVault);\n        if (keyVault.Resource.IsEmulator())\n        {\n            throw new InvalidOperationException(\"Cannot create a Microsoft Foundry project connection to an emulator Key Vault.\");\n        }\n        builder.WithRoleAssignments(keyVault, KeyVaultBuiltInRole.KeyVaultSecretsOfficer);\n        // Configuration based on https://github.com/azure-ai-foundry/foundry-samples/blob/9551912af4d4fdb8ea73e996145e940a7e369c84/infrastructure/infrastructure-setup-bicep/01-connections/connection-key-vault.bicep\n        // We use a custom subclass because Azure.Provisioning.CognitiveServices does not support the \"AzureKeyVault\" connection category yet (as of 2026-01-06).\n        // We also swap `ManagedIdentity` auth type for `AccountManagedIdentity`, because the latter seems to be an error in the Bicep template.\n        return builder.AddConnection($\"{keyVault.Resource.Name}-{Guid.NewGuid():N}\", (infra) =>\n        {\n            var vault = (KeyVaultService)keyVault.Resource.AddAsExistingResource(infra);\n            return new AzureKeyVaultConnectionProperties()\n            {\n                Target = vault.Id,\n                IsSharedToAll = true,\n                Metadata =\n                {\n                    { \"ApiType\", \"Azure\" },\n                    { \"ResourceId\", vault.Id },\n                    { \"location\", vault.Location }\n                }","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Foundry/Project/ConnectionBuilderExtensions.cs#L293-L329","documentation":"Foundry project connections to Key Vault require a real vault. AddConnection for Key Vault throws this InvalidOperationException when the supplied AzureKeyVaultResource is emulated (keyVault.Resource.IsEmulator()), because the Foundry service cannot authenticate to a local fake vault.","triggerScenarios":"Calling foundryProject.AddConnection(keyVault) where the AzureKeyVaultResource was created with RunAsEmulator() so keyVault.Resource.IsEmulator() is true.","commonSituations":"Local development with an emulated Key Vault combined with Foundry connection wiring; sample apps that default vaults to emulator mode.","solutions":["Remove RunAsEmulator() from the Key Vault resource so a real vault is provisioned.","Add the connection conditionally, skipping it when the vault is emulated.","Declare a separate non-emulated Key Vault resource as the connection target."],"exampleFix":"// before\nvar kv = builder.AddAzureKeyVault(\"kv\").RunAsEmulator();\nproject.AddConnection(kv); // throws\n\n// after\nvar kv = builder.AddAzureKeyVault(\"kv\");\nproject.AddConnection(kv);","handlingStrategy":"validation","validationCode":"if (!keyVault.Resource.IsEmulator())\n    project.AddConnection(keyVault);","typeGuard":null,"tryCatchPattern":"try { project.AddConnection(keyVault); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"emulator Key Vault\")) { /* skip or provision real Key Vault */ }","preventionTips":["Check keyVault.Resource.IsEmulator() before adding the connection.","Remember AddConnection also applies role assignments (KeyVaultSecretsOfficer), which only makes sense for real vaults.","Condition emulation on execution context rather than hardcoding RunAsEmulator."],"tags":["azure-ai-foundry","key-vault","emulator","connection"],"backgroundTag":"unsupported-operation","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}