microsoft/aspire · error · InvalidOperationException

ASPIRERADIUS010

ASPIRERADIUS010

Error message

WithAzureProvider requires a credential mode to be selected via the configure callback (e.g. azure.WithServicePrincipal(...)). Diagnostic: ASPIRERADIUS010.

What it means

WithAzureProvider requires the configure callback to select a credential mode on the AzureRadiusProviderBuilder (e.g. azure.WithServicePrincipal(...)). If the callback runs but never assigns providerBuilder.Credential, the extension throws InvalidOperationException with diagnostic code ASPIRERADIUS010, because the Radius Azure cloud provider cannot be synthesized without a credential.

Solutions

1. Call a credential method such as azure.WithServicePrincipal(...) inside the configure callback.
2. Ensure the credential assignment is not behind a false condition; make the credential unconditional or fix the condition.
3. If you truly have no credentials yet, defer calling WithAzureProvider until credentials are available.

Example fix

// before
.WithAzureProvider(subscriptionId, resourceGroup, azure =>
{
    // no credential selected
})
// after
.WithAzureProvider(subscriptionId, resourceGroup, azure =>
{
    azure.WithServicePrincipal(clientId, clientSecret, tenantId);
})

// Ensure credentials are configured before building
if (string.IsNullOrEmpty(clientId) || string.IsNullOrEmpty(tenantId))
{
    throw new InvalidOperationException("Azure provider credential values must be set before calling WithAzureProvider");
}

try { builder.AddRadius().WithAzureProvider(sub, rg, azure => azure.WithServicePrincipal(clientId, secret, tenantId)); }
catch (InvalidOperationException ex) when (ex.Message.Contains("ASPIRERADIUS010")) { logger.LogError("Azure Radius provider configured without a credential"); throw; }

When it happens

Trigger: Calling .WithAzureProvider(subscriptionId, resourceGroup, configure) where the configure callback either has an empty body, only sets other properties, or uses a condition that skips every With* credential method, leaving AzureRadiusProviderBuilder.Credential null.

Common situations: Copy-pasting the WithAzureProvider call from docs but forgetting the callback body; refactoring out a WithServicePrincipal call; conditionally adding credentials at runtime where the condition evaluates false; assuming a default (managed identity) credential exists when none does.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• A recipe parameter on Radius environment
• ASPIRERADIUS011
• rad credential register failed with exit code
• Unknown Azure credential type
• A BlobServiceClient could not be configured. Ensure valid…

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/e989f1dabc698d56. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Radius/CloudProviders/RadiusCloudProviderExtensions.cs:57

    [AspireExportIgnore(Reason = "The credential-selection callback exposes the in-flight provider builder interface, which the ATS exporter cannot render (ASPIREEXPORT008).")]
    [Experimental("ASPIRERADIUS003", UrlFormat = "https://aka.ms/aspire/diagnostics/{0}")]
    public static IResourceBuilder<RadiusEnvironmentResource> WithAzureProvider(
        this IResourceBuilder<RadiusEnvironmentResource> builder,
        string subscriptionId,
        string resourceGroup,
        Action<IAzureRadiusProviderBuilder> configure)
    {
        ArgumentNullException.ThrowIfNull(builder);
        CloudProviderValidation.ValidateGuid(subscriptionId, nameof(subscriptionId));
        CloudProviderValidation.ValidateNonEmpty(resourceGroup, nameof(resourceGroup));
        ArgumentNullException.ThrowIfNull(configure);

        var providerBuilder = new AzureRadiusProviderBuilder();
        configure(providerBuilder);

        if (providerBuilder.Credential is null)
        {
            throw new InvalidOperationException(
                "WithAzureProvider requires a credential mode to be selected " +
                "via the configure callback (e.g. azure.WithServicePrincipal(...)). " +
                "Diagnostic: ASPIRERADIUS010.");
        }

        var config = new AzureRadiusProviderConfig(subscriptionId, resourceGroup, providerBuilder.Credential);
        RadiusCloudProvidersAnnotation.GetOrAdd(builder.Resource).Azure = config;
        return builder;
    }

    /// <summary>
    /// Attaches an AWS cloud provider to the Radius environment. The
    /// <paramref name="configure"/> callback selects exactly one credential
    /// mode (Access Key or IRSA); omitting a selection is an error.
    /// </summary>
    /// <param name="builder">The Radius environment resource builder.</param>
    /// <param name="accountId">12-digit AWS account ID.</param>
    /// <param name="region">AWS region code (e.g. <c>us-west-2</c>).</param>

View on GitHub (pinned to 25830f84bd)