microsoft/aspire · error · InvalidOperationException

Access policy ' ' is already registered on connector…

Error message

Access policy '{policyName}' is already registered on connector connection '{connection.Name}'.

What it means

Each access policy on a connector connection must have a unique policy name. GetValidatedAccessPolicyResourceName throws this InvalidOperationException when a policy with the same PolicyName (case-insensitive) is already registered on the connection.

Solutions

Use a distinct policy name for the new policy.
Remove the duplicate WithAccessPolicy call.
Guard with a check of existing policy names before adding.

Example fix

// before
connection.WithAccessPolicy("p1", objectId, tenantId, PrincipalType.User);
connection.WithAccessPolicy("p2", objectId, tenantId, PrincipalType.User); // same resolved policyName
// after
connection.WithAccessPolicy("p1", objectId, tenantId, PrincipalType.User);

Defensive patterns

Strategy: validation

Validate before calling

if (connection.AccessPolicies.Any(p => string.Equals(p.PolicyName, policyName, StringComparison.OrdinalIgnoreCase)))
{
    // policy already present; skip the call
}

Try / catch

try { connection.WithAccessPolicy(name, objectId, tenantId, principalType); }
catch (InvalidOperationException ex) when (ex.Message.StartsWith("Access policy '"))
{
    // skip duplicate or pick another policy name
}

Prevention

Do not register the same principal under multiple policy names.
Centralize policy registration to avoid duplicates.
Check existing policies before adding.

When it happens

Trigger: Calling WithAccessPolicy twice on the same connector connection where both policies resolve to the same policy name, even if the resource names differ.

Common situations: Registering the same Entra principal under two resource names; a shared helper that derives identical policy names for repeated calls; copy-pasted builder code.

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/aba364a6ca8dd4e2. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.ConnectorNamespace/AzureConnectorNamespaceExtensions.cs:678

        AzureConnectorNamespaceConnectionResource connection,
        string name,
        string policyName)
    {
        var resourceName = ConnectorNamespaceBicepIdentifiers.CreateAccessPolicy(
            connection.Parent.Name,
            connection.Name,
            name);
        if (connection.AccessPolicies.Any(policy =>
            string.Equals(policy.BicepIdentifier, resourceName, StringComparison.OrdinalIgnoreCase)))
        {
            throw new InvalidOperationException(
                $"Access policy resource '{name}' is already registered on connector connection '{connection.Name}'.");
        }

        if (connection.AccessPolicies.Any(policy =>
            string.Equals(policy.PolicyName, policyName, StringComparison.OrdinalIgnoreCase)))
        {
            throw new InvalidOperationException(
                $"Access policy '{policyName}' is already registered on connector connection '{connection.Name}'.");
        }

        return resourceName;
    }

    private static string GetValidatedMcpAccessPolicyResourceName(
        AzureConnectorNamespaceMcpServerConfigResource config,
        string name,
        string objectId)
    {
        var resourceName = ConnectorNamespaceBicepIdentifiers.CreateMcpAccessPolicy(
            config.Parent.Name,
            config.Name,
            name);
        if (config.AccessPolicies.Any(policy =>
            string.Equals(policy.BicepIdentifier, resourceName, StringComparison.OrdinalIgnoreCase)))
        {

View on GitHub (pinned to 25830f84bd)