0

I have a VM in a scale set which has a user-assigned MSI attached to it. This MSI has read access to a specific key vault, set-up in its access policy tab.

From within a VM I need to access the key vault. az CLI is installed on the VM. When trying to log-in I'm getting the following error:

> az login --identity -u /subscriptions/subscriptionId/resourcegroups/group/providers/Microsoft.ManagedIdentity/userAssignedIdentities/name       
No access was configured for the VM, hence no subscriptions were found

When I login interactively with az login and enter the displayed code at https://microsoft.com/devicelogin it works great...

However, the point of using MSI is to have it work without interaction...

Did somebody else have this problem?

Stefan Becker
  • 5,695
  • 9
  • 20
  • 30
baouss
  • 1,312
  • 1
  • 22
  • 52

1 Answers1

0

Az login --identity is for accessing Azure Resource Manager. This enables you to perform control-plane/management operations over Key Vault. This is the equivalent of getting a token for https://management.azure.com/

Key Vault access policies enable data-plane access to the Vault. For this, you'll need a token for https://vault.azure.net

Check out the following tutorials:

Linux: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-linux-vm-access-nonaad

Windows: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad

Arturo Lucatero - MSFT
  • 291
  • 1
  • 9
  • Thank you, I didn't realise this. I quickly confirmed this by giving the MSI reader access in IAM, et voilà, az login -i -u works. After that I am able to retrieve secrets via az cli. However, I was my understanding that the az cli is just a wrapper around the REST calls, so I expected *az keyvault secret -n name --vault-name vault* to be equivalent to the procedure demonstrated in your links. Also, previously, this same command (before it worked with your tips) asked me to sign in using az login... – baouss Feb 07 '19 at 07:30