microsoft/aspire · error · InvalidOperationException

Access policy resource

Error message

Access policy resource '{name}' is already registered on connector connection '{connection.Name}'.

What it means

When adding an access policy to a connector connection, the derived Bicep identifier (resource name) must be unique among the policies already registered on that connection. GetValidatedAccessPolicyResourceName throws this InvalidOperationException when a policy with the same BicepIdentifier already exists on the connection.

Solutions

Use a different resource name for the new policy.
Remove the earlier WithAccessPolicy call that already registers the name on this connection.
Check connection.AccessPolicies before adding to skip already-registered names.

Example fix

// before
connection.WithAccessPolicy("adminPolicy", objectId, tenantId, PrincipalType.User);
connection.WithAccessPolicy("adminPolicy", otherObjectId, tenantId, PrincipalType.User);
// after
connection.WithAccessPolicy("adminPolicy", objectId, tenantId, PrincipalType.User);
connection.WithAccessPolicy("adminPolicy2", otherObjectId, tenantId, PrincipalType.User);

Defensive patterns

Strategy: validation

Validate before calling

if (connection.AccessPolicies.Any(p => string.Equals(p.BicepIdentifier, name, StringComparison.OrdinalIgnoreCase)))
{
    // skip or rename before calling WithAccessPolicy
}

Try / catch

try { connection.WithAccessPolicy(name, objectId, tenantId, principalType); }
catch (InvalidOperationException ex) when (ex.Message.Contains("already registered"))
{
    // choose a different resource name or skip
}

Prevention

Track resource names you have already registered per connection.
Avoid shared helpers that unconditionally add the same policy.
Use distinct, descriptive policy resource names.

When it happens

Trigger: Calling WithAccessPolicy (or resourceName) twice on the same connector connection with the same resource name, ignoring case.

Common situations: Applying a shared extension/helper method that adds the same policy multiple times; duplicate builder configuration across code paths; case differences masking the duplicate.

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/ba081a5c6e6e2a78. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.ConnectorNamespace/AzureConnectorNamespaceExtensions.cs:671

        return new BinaryExpression(
            value,
            BinaryBicepOperator.Coalesce,
            new StringLiteralExpression(string.Empty));
    }

    private static string GetValidatedAccessPolicyResourceName(
        AzureConnectorNamespaceConnectionResource connection,
        string name,
        string policyName)
    {
        var resourceName = ConnectorNamespaceBicepIdentifiers.CreateAccessPolicy(
            connection.Parent.Name,
            connection.Name,
            name);
        if (connection.AccessPolicies.Any(policy =>
            string.Equals(policy.BicepIdentifier, resourceName, StringComparison.OrdinalIgnoreCase)))
        {
            throw new InvalidOperationException(
                $"Access policy resource '{name}' is already registered on connector connection '{connection.Name}'.");
        }

        if (connection.AccessPolicies.Any(policy =>
            string.Equals(policy.PolicyName, policyName, StringComparison.OrdinalIgnoreCase)))
        {
            throw new InvalidOperationException(
                $"Access policy '{policyName}' is already registered on connector connection '{connection.Name}'.");
        }

        return resourceName;
    }

    private static string GetValidatedMcpAccessPolicyResourceName(
        AzureConnectorNamespaceMcpServerConfigResource config,
        string name,
        string objectId)
    {

View on GitHub (pinned to 25830f84bd)