mongodb/node-mongodb-native · error · MongoAzureError

Status code ${response.status} returned from the Azure endpo

Error message

Status code ${response.status} returned from the Azure endpoint. Response body: ${response.body}

What it means

Thrown by the Azure machine workflow when the Azure IMDS endpoint returns an HTTP status other than 200 (src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts:46). The error includes the status code and the response body to aid diagnosis. Surfaced as a MongoAzureError.

Source

Thrown at src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts:47

  }
  const response = await getAzureTokenData(tokenAudience, username);
  if (!isEndpointResultValid(response)) {
    throw new MongoAzureError(ENDPOINT_RESULT_ERROR);
  }
  return response;
};

/**
 * Hit the Azure endpoint to get the token data.
 */
async function getAzureTokenData(tokenAudience: string, username?: string): Promise<OIDCResponse> {
  const url = new URL(AZURE_BASE_URL);
  addAzureParams(url, tokenAudience, username);
  const response = await get(url, {
    headers: AZURE_HEADERS
  });
  if (response.status !== 200) {
    throw new MongoAzureError(
      `Status code ${response.status} returned from the Azure endpoint. Response body: ${response.body}`
    );
  }
  const result = JSON.parse(response.body);
  return {
    accessToken: result.access_token,
    expiresInSeconds: Number(result.expires_in)
  };
}

/**
 * Determines if a result returned from the endpoint is valid.
 * This means the result is not nullish, contains the access_token required field
 * and the expires_in required field.
 */
function isEndpointResultValid(
  token: unknown
): token is { access_token: unknown; expires_in: unknown } {

View on GitHub (pinned to 3366c21a63)

Solutions

1. Read the response body in the error message - Azure typically explains the failure (e.g. 'Identity not found').
2. Attach a system or user-assigned managed identity to the compute resource.
3. Ensure the identity is permitted to request tokens for the configured TOKEN_RESOURCE.
4. If not on Azure, switch ENVIRONMENT to the correct provider (gcp/k8s) or use a callback workflow.

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoAzureError && /Status code \d+ returned from the Azure endpoint/.test(e.message)) {
    // The message includes Azure's response body - inspect it for the cause (identity missing, audience invalid)
    log.error('Azure IMDS error', e.message);
  }
  throw e;
}

When it happens

Trigger: The GET request to http://169.254.169.254/metadata/identity/oauth2/token (with audience params) returns a non-200 status such as 400 (bad request / missing identity), 403 (identity not allowed for audience), 404, or 503.

Common situations: No managed identity attached to the VM (400 with 'Identity not found'), the requested TOKEN_RESOURCE audience is invalid for the identity, IMDS throttling (429), or the workload is not running on Azure at all so the endpoint is unreachable / proxied.

Related errors

• Azure endpoint did not return a value with only access_token
• TOKEN_RESOURCE must be set in the auth mechanism properties
• OIDC callback timed out after ${AUTOMATED_TIMEOUT_MS}ms.
• TOKEN_RESOURCE must be set in the auth mechanism properties
• Status code ${response.status} returned from the GCP endpoin

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/4c6afc8c1b124488.json. Report an issue: GitHub.