Description
The cli_generate tool returns a 401 Unauthorized error when authenticating via User-assigned Managed Identity on an Azure Container App. Able to connect to Azure MCP with the same identity and configuration (getting available tools count).
Environment
Azure MCP Server version: 2.0.5 (2.0.5+2712e19ddf1c55f8e73ead8fb671915ec92801cc)
Compute: Azure Container App
Auth method: User-assigned Managed Identity
Client: Python MAF agent connecting via stdio
Tenant: Microsoft corporate tenant
Configuration
AZURE_CLIENT_ID=cfdece33... (matches MI assigned to Container App)
AZURE_MCP_INCLUDE_PRODUCTION_CREDENTIALS=true
AZURE_TENANT_ID set
RBAC
Managed Identity has Reader role on the subscription
Error
Plain text
{
"status": 401,
"message": "Service unavailable or network connectivity issues. Details: Response status code does not indicate success: 401 (Unauthorized).. To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azmcp/troubleshooting.",
"results": {
"message": "Response status code does not indicate success: 401 (Unauthorized).",
"type": "HttpRequestException"
},
"duration": 0
}
What I've tried
Verified MI client ID matches the one assigned to the Container App
Added AZURE_TENANT_ID
Confirmed Reader role is active on subscription
Upgraded to latest version (2.0.5)
Related issue
This appears similar to Issue 1215 which was closed but does not clarify root cause for Managed Identity scenarios.
Questions
Does cli_generate support Managed Identity, or does it require user-level (interactive) authentication?
If MI is supported, what specific RBAC role is needed for the backend service cli_generate calls?
Is there documentation on the auth requirements for this specific tool?
Who owns the backend api being called from this tool?
Thank you!
Description
The cli_generate tool returns a 401 Unauthorized error when authenticating via User-assigned Managed Identity on an Azure Container App. Able to connect to Azure MCP with the same identity and configuration (getting available tools count).
Environment
Azure MCP Server version: 2.0.5 (2.0.5+2712e19ddf1c55f8e73ead8fb671915ec92801cc)
Compute: Azure Container App
Auth method: User-assigned Managed Identity
Client: Python MAF agent connecting via stdio
Tenant: Microsoft corporate tenant
Configuration
AZURE_CLIENT_ID=cfdece33... (matches MI assigned to Container App)
AZURE_MCP_INCLUDE_PRODUCTION_CREDENTIALS=true
AZURE_TENANT_ID set
RBAC
Managed Identity has Reader role on the subscription
Error
Plain text
{
"status": 401,
"message": "Service unavailable or network connectivity issues. Details: Response status code does not indicate success: 401 (Unauthorized).. To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azmcp/troubleshooting.",
"results": {
"message": "Response status code does not indicate success: 401 (Unauthorized).",
"type": "HttpRequestException"
},
"duration": 0
}
What I've tried
Verified MI client ID matches the one assigned to the Container App
Added AZURE_TENANT_ID
Confirmed Reader role is active on subscription
Upgraded to latest version (2.0.5)
Related issue
This appears similar to Issue 1215 which was closed but does not clarify root cause for Managed Identity scenarios.
Questions
Does cli_generate support Managed Identity, or does it require user-level (interactive) authentication?
If MI is supported, what specific RBAC role is needed for the backend service cli_generate calls?
Is there documentation on the auth requirements for this specific tool?
Who owns the backend api being called from this tool?
Thank you!