microsoft/aspire · error · InvalidOperationException

Access policy resource

Error message

Access policy resource '{name}' is already registered on MCP server configuration '{config.Name}'.

What it means

Access policies on an MCP server configuration must have unique Bicep identifiers. GetValidatedMcpAccessPolicyResourceName throws this InvalidOperationException when a policy with the same resource name (case-insensitive) is already registered on the configuration.

Solutions

  1. Pass a different resource name for the new policy.
  2. Remove the duplicate WithAccessPolicy call on the configuration.
  3. Check config.AccessPolicies before adding to skip existing names.

Example fix

// before
config.WithAccessPolicy("reader", objectId, tenantId, PrincipalType.User);
config.WithAccessPolicy("reader", objectId2, tenantId2, PrincipalType.User);
// after
config.WithAccessPolicy("reader", objectId, tenantId, PrincipalType.User);
config.WithAccessPolicy("reader2", objectId2, tenantId2, PrincipalType.User);
Defensive patterns

Strategy: validation

Validate before calling

if (config.AccessPolicies.Any(p => string.Equals(p.BicepIdentifier, name, StringComparison.OrdinalIgnoreCase)))
{
    // skip or rename before calling WithAccessPolicy on the MCP configuration
}

Try / catch

try { config.WithAccessPolicy(name, objectId, tenantId, principalType); }
catch (InvalidOperationException ex) when (ex.Message.Contains("already registered"))
{
    // use a different resource name or skip
}

Prevention

When it happens

Trigger: Calling WithAccessPolicy twice on the same MCP server configuration with the same resource name argument.

Common situations: Repeated configuration of the same policy through shared extension helpers; duplicating builder wiring for multiple environments in one AppHost; case-only differences in names.

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/f4e231c57abf7862. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.ConnectorNamespace/AzureConnectorNamespaceExtensions.cs:697

                $"Access policy '{policyName}' is already registered on connector connection '{connection.Name}'.");
        }

        return resourceName;
    }

    private static string GetValidatedMcpAccessPolicyResourceName(
        AzureConnectorNamespaceMcpServerConfigResource config,
        string name,
        string objectId)
    {
        var resourceName = ConnectorNamespaceBicepIdentifiers.CreateMcpAccessPolicy(
            config.Parent.Name,
            config.Name,
            name);
        if (config.AccessPolicies.Any(policy =>
            string.Equals(policy.BicepIdentifier, resourceName, StringComparison.OrdinalIgnoreCase)))
        {
            throw new InvalidOperationException(
                $"Access policy resource '{name}' is already registered on MCP server configuration '{config.Name}'.");
        }

        if (config.AccessPolicies.Any(policy =>
            string.Equals(policy.ObjectId, objectId, StringComparison.OrdinalIgnoreCase)))
        {
            throw new InvalidOperationException(
                $"An access policy for principal '{objectId}' is already registered on MCP server configuration '{config.Name}'.");
        }

        return resourceName;
    }

    private static void ValidateMcpAccessPolicyOptions(AzureConnectorNamespaceMcpAccessPolicyOptions options)
    {
        ValidateEntraPrincipalIds(
            options.ObjectId,
            options.TenantId,

View on GitHub (pinned to 25830f84bd)