dotnet/orleans · error · InvalidOperationException

AzureTable:ServiceUri must be an absolute HTTPS Azure Table

Error message

AzureTable:ServiceUri must be an absolute HTTPS Azure Table service URI.

What it means

An InvalidOperationException thrown by AzureTableServiceClientFactory.Create when AzureTable:ServiceUri is present but is not an absolute HTTPS URI. The factory only supports token/managed-identity auth over HTTPS to the Azure Table service, so a relative URL, http:// URL, or non-URI string is rejected before constructing a TableServiceClient.

Source

Thrown at samples/Deployment/AzureContainerApps/Infrastructure/AzureTableServiceClientFactory.cs:18

using Azure.Data.Tables;
using Azure.Identity;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.Hosting;

namespace Infrastructure;

public static class AzureTableServiceClientFactory
{
    public static TableServiceClient Create(IConfiguration configuration, IHostEnvironment environment)
    {
        var serviceUriValue = configuration["AzureTable:ServiceUri"];
        if (!string.IsNullOrWhiteSpace(serviceUriValue))
        {
            if (!Uri.TryCreate(serviceUriValue, UriKind.Absolute, out var serviceUri)
                || serviceUri.Scheme != Uri.UriSchemeHttps)
            {
                throw new InvalidOperationException(
                    "AzureTable:ServiceUri must be an absolute HTTPS Azure Table service URI.");
            }

            var credentialOptions = new DefaultAzureCredentialOptions();
            var managedIdentityClientId = GetRequiredValue(configuration, "AZURE_CLIENT_ID");
            if (!Guid.TryParse(managedIdentityClientId, out _))
            {
                throw new InvalidOperationException(
                    "AZURE_CLIENT_ID must contain the user-assigned managed identity client ID.");
            }

            credentialOptions.ManagedIdentityClientId = managedIdentityClientId;
            return new TableServiceClient(serviceUri, new DefaultAzureCredential(credentialOptions));
        }

        var connectionString = configuration["AzureTable:ConnectionString"];
        if (environment.IsDevelopment()
            && string.Equals(connectionString, "UseDevelopmentStorage=true", StringComparison.OrdinalIgnoreCase))

View on GitHub (pinned to fca799fa70)

Solutions

Set AzureTable:ServiceUri to a valid absolute https Table service URI (e.g., https://<account>.table.core.windows.net).
For local dev with Azurite, leave ServiceUri unset and set AzureTable:ConnectionString=UseDevelopmentStorage=true (the dev branch handles it).
Double-check there is no leading/trailing whitespace or missing scheme.

Example fix

// before (config)
"AzureTable": { "ServiceUri": "http://127.0.0.1:10002/devstoreaccount1" }

// after (production)
"AzureTable": { "ServiceUri": "https://myaccount.table.core.windows.net" }

Defensive patterns

Strategy: validation

Validate before calling

var uri = configuration["AzureTable:ServiceUri"];
if (!string.IsNullOrWhiteSpace(uri)
    && (!Uri.TryCreate(uri, UriKind.Absolute, out var u) || u.Scheme != Uri.UriSchemeHttps))
    throw new InvalidOperationException("AzureTable:ServiceUri must be an absolute HTTPS URI.");

Prevention

Always use the https:// scheme for cloud Table endpoints.
For local dev, prefer the Azurite connection-string branch.
Validate URIs in a config-validation step at startup.

When it happens

Trigger: Configuration sets AzureTable:ServiceUri to an http:// endpoint, a relative path, a connection string, or a malformed value. Uri.TryCreate with UriKind.Absolute fails or the scheme is not 'https'.

Common situations: Pasting a connection string into the ServiceUri key by mistake. Using http during local debugging (Azurite) instead of the connection-string branch. Typos like missing 'https://'.

Related errors

AI-assisted analysis of dotnet/orleans@fca799fa70 (2026-08-13). Data as JSON: /api/errors/6f21f98deadadb2e. Report an issue: GitHub.