microsoft/aspire · error · ArgumentException

Role ' ' at index is not a valid AzureAppConfigurationRole…

Error message

Role '{roles[i]}' at index {i} is not a valid AzureAppConfigurationRole value.

What it means

WithRoleAssignments maps the public AzureAppConfigurationRole enum to the underlying AppConfigurationBuiltInRole. Any value outside the two known enum members falls into the default arm and throws this ArgumentException naming the offending role and its index in the roles array.

Solutions

1. Pass only AzureAppConfigurationRole.AppConfigurationDataOwner or AzureAppConfigurationRole.AppConfigurationDataReader
2. Remove invalid casts; construct roles as explicit enum values, not ints
3. Upgrade the Aspire.Hosting.Azure.AppConfiguration package if you need newly added roles

Example fix

// before
builder.AddAzureAppConfiguration("config").WithRoleAssignments(appConfig, (AzureAppConfigurationRole)5);
// after
builder.AddAzureAppConfiguration("config").WithRoleAssignments(appConfig, AzureAppConfigurationRole.AppConfigurationDataOwner);

if (!Enum.IsDefined(typeof(AzureAppConfigurationRole), role))
{
    throw new ArgumentException($"Unsupported role {role}", nameof(roles));
}

static bool IsValidAppConfigRole(AzureAppConfigurationRole role) =>
    role is AzureAppConfigurationRole.AppConfigurationDataOwner
         or AzureAppConfigurationRole.AppConfigurationDataReader;

try { builder.WithRoleAssignments(appConfig, roles); }
catch (ArgumentException ex)
{
    logger.LogError(ex, "Invalid AzureAppConfigurationRole supplied");
}

When it happens

Trigger: Calling WithRoleAssignments(builder, target, params AzureAppConfigurationRole[]) with a value that is not AzureAppConfigurationRole.AppConfigurationDataOwner or AppConfigurationDataReader — typically an invalid cast, a hardcoded integer cast to the enum, or an enum member added in a newer package version while the extension maps only known members.

Common situations: Developers casting arbitrary ints to AzureAppConfigurationRole, copying role code from other Azure integrations (e.g. Cosmos/Key Vault role enums) and passing them here, or SDK upgrades introducing new roles the installed extension version does not yet support.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Invalid Azure AI Search role
• ' ' is not a valid AzureContainerRegistryRole value.
• ' ' is not a valid AzureKeyVaultRole value.
• ' ' is not a valid value.
• ' ' is not a valid value.

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/7563032b5932698a. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.AppConfiguration/AzureAppConfigurationExtensions.cs:240

    internal static IResourceBuilder<T> WithRoleAssignments<T>(
        this IResourceBuilder<T> builder,
        IResourceBuilder<AzureAppConfigurationResource> target,
        params AzureAppConfigurationRole[] roles)
        where T : IResource
    {
        if (roles is null || roles.Length == 0)
        {
            return builder.WithRoleAssignments(target, Array.Empty<AppConfigurationBuiltInRole>());
        }

        var builtInRoles = new AppConfigurationBuiltInRole[roles.Length];
        for (var i = 0; i < roles.Length; i++)
        {
            builtInRoles[i] = roles[i] switch
            {
                AzureAppConfigurationRole.AppConfigurationDataOwner => AppConfigurationBuiltInRole.AppConfigurationDataOwner,
                AzureAppConfigurationRole.AppConfigurationDataReader => AppConfigurationBuiltInRole.AppConfigurationDataReader,
                _ => throw new ArgumentException($"Role '{roles[i]}' at index {i} is not a valid {nameof(AzureAppConfigurationRole)} value.", nameof(roles))
            };
        }

        return builder.WithRoleAssignments(target, builtInRoles);
    }

    /// <summary>
    /// Configures anonymous authentication for the Azure App Configuration emulator resource.
    /// </summary>
    /// <param name="builder">The resource builder for the Azure App Configuration emulator.</param>
    /// <param name="role">The role to assign to the anonymous user. Defaults to "Owner".</param>
    /// <returns>The updated resource builder for further configuration.</returns>
    internal static IResourceBuilder<AzureAppConfigurationEmulatorResource> WithAnonymousAccess(this IResourceBuilder<AzureAppConfigurationEmulatorResource> builder, string role = "Owner")
    {
        builder.WithEnvironment("Tenant:AnonymousAuthEnabled", "true");
        builder.WithEnvironment("Authentication:Anonymous:AnonymousUserRole", role);
        return builder;
    }

View on GitHub (pinned to 25830f84bd)