{"record":{"id":"a8bbb158e0564f1c","repo":"dotnet/orleans","slug":"azure-client-id-must-contain-the-user-assigned-man","errorCode":null,"errorMessage":"AZURE_CLIENT_ID must contain the user-assigned managed identity client ID.","messagePattern":"AZURE_CLIENT_ID must contain the user-assigned managed identity client ID\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"samples/Deployment/AzureContainerApps/Infrastructure/AzureTableServiceClientFactory.cs","lineNumber":26,"sourceCode":"public static class AzureTableServiceClientFactory\n{\n    public static TableServiceClient Create(IConfiguration configuration, IHostEnvironment environment)\n    {\n        var serviceUriValue = configuration[\"AzureTable:ServiceUri\"];\n        if (!string.IsNullOrWhiteSpace(serviceUriValue))\n        {\n            if (!Uri.TryCreate(serviceUriValue, UriKind.Absolute, out var serviceUri)\n                || serviceUri.Scheme != Uri.UriSchemeHttps)\n            {\n                throw new InvalidOperationException(\n                    \"AzureTable:ServiceUri must be an absolute HTTPS Azure Table service URI.\");\n            }\n\n            var credentialOptions = new DefaultAzureCredentialOptions();\n            var managedIdentityClientId = GetRequiredValue(configuration, \"AZURE_CLIENT_ID\");\n            if (!Guid.TryParse(managedIdentityClientId, out _))\n            {\n                throw new InvalidOperationException(\n                    \"AZURE_CLIENT_ID must contain the user-assigned managed identity client ID.\");\n            }\n\n            credentialOptions.ManagedIdentityClientId = managedIdentityClientId;\n            return new TableServiceClient(serviceUri, new DefaultAzureCredential(credentialOptions));\n        }\n\n        var connectionString = configuration[\"AzureTable:ConnectionString\"];\n        if (environment.IsDevelopment()\n            && string.Equals(connectionString, \"UseDevelopmentStorage=true\", StringComparison.OrdinalIgnoreCase))\n        {\n            return new TableServiceClient(connectionString);\n        }\n\n        throw new InvalidOperationException(\n            \"Configure AzureTable:ServiceUri for Azure, or use Azurite with \"\n            + \"AzureTable:ConnectionString=UseDevelopmentStorage=true in Development.\");\n    }","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/dotnet/orleans/blob/fca799fa70ecb6ad975224271703ca43221f58de/samples/Deployment/AzureContainerApps/Infrastructure/AzureTableServiceClientFactory.cs#L8-L44","documentation":"An InvalidOperationException thrown by AzureTableServiceClientFactory.Create when AzureTable:ServiceUri is a valid HTTPS URI but AZURE_CLIENT_ID does not parse as a GUID. The factory builds a DefaultAzureCredential with ManagedIdentityClientId, which must be the client ID (a Guid) of a user-assigned managed identity; a non-GUID value would produce a credential that cannot resolve the identity.","triggerScenarios":"The HTTPS service URI path is taken, but AZURE_CLIENT_ID is missing, an object ID (not a client ID), an application URI, or a mistyped string. Guid.TryParse returns false.","commonSituations":"Confusing the managed identity's object/principal ID with its client ID. Copying the tenant ID. The env var unset in the container app but ServiceUri set, so GetRequiredValue already caught empty — here the value is present but malformed.","solutions":["Set AZURE_CLIENT_ID to the user-assigned managed identity's client ID (a GUID) found in the identity's Azure portal properties.","Confirm you are using the 'Client ID' (appId), not the 'Object ID' or 'Principal ID'.","If using a system-assigned identity instead, remove ServiceUri handling or refactor the factory to omit ManagedIdentityClientId."],"exampleFix":"// before (env)\nAZURE_CLIENT_ID=my-storage-account\n\n// after\nAZURE_CLIENT_ID=12345678-1234-1234-1234-1234567890ab","handlingStrategy":"validation","validationCode":"var clientId = configuration[\"AZURE_CLIENT_ID\"];\nif (!Guid.TryParse(clientId, out _))\n    throw new InvalidOperationException(\"AZURE_CLIENT_ID must be a GUID (user-assigned managed identity client ID).\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the managed identity's Client ID (a GUID), not its Object/Principal ID.","Copy the value from the identity's portal properties, not the tenant/app registration overview.","For system-assigned identities, omit ManagedIdentityClientId."],"tags":["azure-storage","managed-identity","configuration","deployment","azure-container-apps","validation"],"backgroundTag":null,"analyzedSha":"fca799fa70ecb6ad975224271703ca43221f58de","analyzedAt":"2026-08-13T19:55:57.938Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}