{"record":{"id":"62736dbd9130d40c","repo":"microsoft/aspire","slug":"an-access-policy-for-principal-objectid-is-already","errorCode":null,"errorMessage":"An access policy for principal '{objectId}' is already registered on MCP server configuration '{config.Name}'.","messagePattern":"An access policy for principal '(.+?)' is already registered on MCP server configuration '(.+?)'\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.ConnectorNamespace/AzureConnectorNamespaceExtensions.cs","lineNumber":704,"sourceCode":"        AzureConnectorNamespaceMcpServerConfigResource config,\n        string name,\n        string objectId)\n    {\n        var resourceName = ConnectorNamespaceBicepIdentifiers.CreateMcpAccessPolicy(\n            config.Parent.Name,\n            config.Name,\n            name);\n        if (config.AccessPolicies.Any(policy =>\n            string.Equals(policy.BicepIdentifier, resourceName, StringComparison.OrdinalIgnoreCase)))\n        {\n            throw new InvalidOperationException(\n                $\"Access policy resource '{name}' is already registered on MCP server configuration '{config.Name}'.\");\n        }\n\n        if (config.AccessPolicies.Any(policy =>\n            string.Equals(policy.ObjectId, objectId, StringComparison.OrdinalIgnoreCase)))\n        {\n            throw new InvalidOperationException(\n                $\"An access policy for principal '{objectId}' is already registered on MCP server configuration '{config.Name}'.\");\n        }\n\n        return resourceName;\n    }\n\n    private static void ValidateMcpAccessPolicyOptions(AzureConnectorNamespaceMcpAccessPolicyOptions options)\n    {\n        ValidateEntraPrincipalIds(\n            options.ObjectId,\n            options.TenantId,\n            \"MCP access policy\",\n            nameof(options.ObjectId),\n            nameof(options.TenantId),\n            nameof(options));\n\n        if (!Enum.IsDefined(options.PrincipalType))\n        {","sourceCodeStart":686,"sourceCodeEnd":722,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.ConnectorNamespace/AzureConnectorNamespaceExtensions.cs#L686-L722","documentation":"Each Entra principal (object ID) may have at most one access policy per MCP server configuration. GetValidatedMcpAccessPolicyResourceName throws this InvalidOperationException when a policy for the same object ID (case-insensitive) already exists on the configuration.","triggerScenarios":"Calling WithAccessPolicy twice on the same MCP server configuration passing the same Entra object ID, even with different resource/policy names.","commonSituations":"Granting the same service principal or managed identity access twice under different names; loops over principals that contain duplicates; re-running configuration code on the same builder.","solutions":["Remove the duplicate WithAccessPolicy call for that object ID.","Reuse the existing policy instead of adding a new one.","Deduplicate principals before configuring, e.g. DistinctBy(p => p.ObjectId, StringComparer.OrdinalIgnoreCase)."],"exampleFix":"// before\nconfig.WithAccessPolicy(\"policyA\", objectId, tenantId, PrincipalType.User);\nconfig.WithAccessPolicy(\"policyB\", objectId, tenantId, PrincipalType.User); // same objectId\n// after\nconfig.WithAccessPolicy(\"policyA\", objectId, tenantId, PrincipalType.User);","handlingStrategy":"validation","validationCode":"if (config.AccessPolicies.Any(p => string.Equals(p.ObjectId, objectId, StringComparison.OrdinalIgnoreCase)))\n{\n    // principal already has a policy; skip\n}","typeGuard":null,"tryCatchPattern":"try { config.WithAccessPolicy(name, objectId, tenantId, principalType); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"principal\"))\n{\n    // skip duplicate principal or reuse existing policy\n}","preventionTips":["Deduplicate principals by object ID before configuring.","Remember one policy per principal per configuration.","Guard loops over principal lists against duplicates."],"tags":["azure","mcp","access-policy","duplicate"],"backgroundTag":"file-already-exists","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}