{"id":"4c6afc8c1b124488","repo":"mongodb/node-mongodb-native","slug":"status-code-response-status-returned-from-the-a","errorCode":null,"errorMessage":"Status code ${response.status} returned from the Azure endpoint. Response body: ${response.body}","messagePattern":"Status code (.+?) returned from the Azure endpoint\\. Response body: (.+?)","errorType":"exception","errorClass":"MongoAzureError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts","lineNumber":47,"sourceCode":"  }\n  const response = await getAzureTokenData(tokenAudience, username);\n  if (!isEndpointResultValid(response)) {\n    throw new MongoAzureError(ENDPOINT_RESULT_ERROR);\n  }\n  return response;\n};\n\n/**\n * Hit the Azure endpoint to get the token data.\n */\nasync function getAzureTokenData(tokenAudience: string, username?: string): Promise<OIDCResponse> {\n  const url = new URL(AZURE_BASE_URL);\n  addAzureParams(url, tokenAudience, username);\n  const response = await get(url, {\n    headers: AZURE_HEADERS\n  });\n  if (response.status !== 200) {\n    throw new MongoAzureError(\n      `Status code ${response.status} returned from the Azure endpoint. Response body: ${response.body}`\n    );\n  }\n  const result = JSON.parse(response.body);\n  return {\n    accessToken: result.access_token,\n    expiresInSeconds: Number(result.expires_in)\n  };\n}\n\n/**\n * Determines if a result returned from the endpoint is valid.\n * This means the result is not nullish, contains the access_token required field\n * and the expires_in required field.\n */\nfunction isEndpointResultValid(\n  token: unknown\n): token is { access_token: unknown; expires_in: unknown } {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts#L29-L65","documentation":"Thrown by the Azure machine workflow when the Azure IMDS endpoint returns an HTTP status other than 200 (src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts:46). The error includes the status code and the response body to aid diagnosis. Surfaced as a MongoAzureError.","triggerScenarios":"The GET request to http://169.254.169.254/metadata/identity/oauth2/token (with audience params) returns a non-200 status such as 400 (bad request / missing identity), 403 (identity not allowed for audience), 404, or 503.","commonSituations":"No managed identity attached to the VM (400 with 'Identity not found'), the requested TOKEN_RESOURCE audience is invalid for the identity, IMDS throttling (429), or the workload is not running on Azure at all so the endpoint is unreachable / proxied.","solutions":["Read the response body in the error message - Azure typically explains the failure (e.g. 'Identity not found').","Attach a system or user-assigned managed identity to the compute resource.","Ensure the identity is permitted to request tokens for the configured TOKEN_RESOURCE.","If not on Azure, switch ENVIRONMENT to the correct provider (gcp/k8s) or use a callback workflow."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoAzureError && /Status code \\d+ returned from the Azure endpoint/.test(e.message)) {\n    // The message includes Azure's response body - inspect it for the cause (identity missing, audience invalid)\n    log.error('Azure IMDS error', e.message);\n  }\n  throw e;\n}","preventionTips":["Ensure the system or user-assigned managed identity is attached and has access to the MongoDB audience.","Use a startup probe that curls IMDS and fails fast on non-200.","Monitor for IMDS throttling (429) under high connection churn."],"tags":["auth","oidc","azure","managed-identity","http-error"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}