git-ecosystem/git-credential-manager · error · ArgumentException

Invalid managed identity id

Error message

Invalid managed identity id '{id}'

What it means

ManagedIdentity.Create validates the user-supplied managed identity identifier and throws ArgumentException when TryCreate rejects it. A valid id is either 'system' (system-assigned), a GUID (interpreted as a user-assigned client ID), or an 'id://{uuid}' or 'resource://{uuid}' URI. Anything else — empty, whitespace, or a non-GUID string without a valid scheme — is rejected.

Solutions

1. Pass 'system' for a system-assigned managed identity.
2. Pass the user-assigned identity's client ID as a GUID string, or a 'id://{guid}' / 'resource://{guid}' URI.
3. Use ManagedIdentity.TryCreate or Guid.TryParse/Uri validation on the value before calling Create.
4. Check the Azure portal/CLI for the correct client ID or resource ID of the user-assigned identity.

Example fix

// before
var mi = ManagedIdentity.Create(identityName); // "my-identity" -> ArgumentException
// after
var mi = Guid.TryParse(clientId, out _) || clientId.Equals("system", StringComparison.OrdinalIgnoreCase)
    ? ManagedIdentity.Create(clientId)
    : ManagedIdentity.Create($"resource://{resourceIdGuid}");

if (string.IsNullOrWhiteSpace(id) ||
    !(id.Equals("system", StringComparison.OrdinalIgnoreCase) ||
      Guid.TryParse(id, out _) ||
      (Uri.TryCreate(id, UriKind.Absolute, out var u) &&
       (u.Scheme.Equals("id", StringComparison.OrdinalIgnoreCase) || u.Scheme.Equals("resource", StringComparison.OrdinalIgnoreCase)))))
    throw new ArgumentException($"Invalid managed identity id '{id}'");

static bool IsValidManagedIdentityId(string id) =>
    !string.IsNullOrWhiteSpace(id) &&
    (id.Equals("system", StringComparison.OrdinalIgnoreCase) ||
     Guid.TryParse(id, out _) ||
     (Uri.TryCreate(id, UriKind.Absolute, out var u) &&
      (u.Scheme.Equals("id", OrdinalIgnoreCase) || u.Scheme.Equals("resource", OrdinalIgnoreCase)) && Guid.TryParse(u.Host, out _)));

try
{
    mi = ManagedIdentity.Create(id);
}
catch (ArgumentException ex)
{
    Console.Error.WriteLine($"Identity id '{id}' invalid: use 'system', a GUID client id, or id://resource:// URI.");
    return;
}

When it happens

Trigger: Calling ManagedIdentity.Create with an empty/whitespace string, a non-GUID name (e.g. the resource's human-readable name), or a malformed URI like 'resource://not-a-guid' or 'clientid://...'.

Common situations: Users entering a managed identity display name instead of its client ID or resource ID; typos or truncation of the GUID; copying an ARM resource path ('/subscriptions/.../resourcegroups/...') rather than the expected 'resource://{uuid}' form; environment variable containing blank value.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• Service principal ' ' must have either a certificate or…

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/ae7eb3346a9d329e. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Authentication/Entra/ManagedIdentity.cs:27

    public static readonly ManagedIdentity System = new("system", ManagedIdentityId.SystemAssigned);

    public static ManagedIdentity FromClientId(Guid clientId)
    {
        var id = clientId.ToString("D");
        return new($"id://{id}", ManagedIdentityId.WithUserAssignedClientId(id));
    }

    public static ManagedIdentity FromResourceId(Guid resourceId)
    {
        var id = resourceId.ToString("D");
        return new($"resource://{id}", ManagedIdentityId.WithUserAssignedResourceId(id));
    }

    public static ManagedIdentity Create(string id) =>
        TryCreate(id, out ManagedIdentity mi)
            ? mi
            : throw new ArgumentException($"Invalid managed identity id '{id}'", nameof(id));

    public static bool TryCreate(string id, out ManagedIdentity mi)
    {
        if (string.IsNullOrWhiteSpace(id))
        {
            mi = null;
            return false;
        }

        if (StringComparer.OrdinalIgnoreCase.Equals(id, "system"))
        {
            mi = System;
            return true;
        }

        // {uuid} => user-assigned client ID
        if (Guid.TryParse(id, out Guid guid))
        {

View on GitHub (pinned to e8ce762cd0)