KeyVaultErrorException: Operation returned an invalid status code 'Forbidden' : <p>I'm trying to set up my web app, hosted in Azure to read settings from Azure KeyVault.</p>

<p>I've been following this guide: <a href="https://anthonychu.ca/post/secrets-aspnet-core-key-vault-msi/" rel="noreferrer">https://anthonychu.ca/post/secrets-aspnet-core-key-vault-msi/</a></p>

<p>The example shows how to access app settings from KeyVault with the configuration:</p>

<pre><code>public static IWebHost BuildWebHost(string[] args) =&gt;
    WebHost.CreateDefaultBuilder(args)
     .ConfigureAppConfiguration((ctx, builder) =&gt;
     {
         var keyVaultEndpoint = Environment.GetEnvironmentVariable("KEYVAULT_ENDPOINT");
         if (!string.IsNullOrEmpty(keyVaultEndpoint))
         {
             var azureServiceTokenProvider = new AzureServiceTokenProvider();
             var keyVaultClient = new KeyVaultClient(
                 new KeyVaultClient.AuthenticationCallback(
                     azureServiceTokenProvider.KeyVaultTokenCallback));
             builder.AddAzureKeyVault(
                 keyVaultEndpoint, keyVaultClient, new DefaultKeyVaultSecretManager());
         }
     })
    .UseApplicationInsights()
    .UseStartup&lt;Startup&gt;()
    .Build();
</code></pre>

<p>I've added the KEYVAULT_ENDPOINT environment variable to the application settings. I've enabled MSI on the app service, and I've authorized my Azure User, and my application, from the Key Vault Access Policies:</p>

<p><a href="https://i.stack.imgur.com/iUv3x.png" rel="noreferrer"><img src="https://i.stack.imgur.com/iUv3x.png" alt="enter image description here"></a></p>

<p>With Get and List Operations:</p>

<p><a href="https://i.stack.imgur.com/47a1K.png" rel="noreferrer"><img src="https://i.stack.imgur.com/47a1K.png" alt="enter image description here"></a> </p>

<p>And I've added the secret to key vault. Running locally, I can access the secret.</p>

<p>But my ASP .NET Core site fails on startup with this in the stdout logs:</p>

<pre><code>Unhandled Exception: Microsoft.Azure.KeyVault.Models.KeyVaultErrorException: Operation returned an invalid status code 'Forbidden'
   at Microsoft.Azure.KeyVault.KeyVaultClient.GetSecretsWithHttpMessagesAsync(String vaultBaseUrl, Nullable`1 maxresults, Dictionary`2 customHeaders, CancellationToken cancellationToken)
   at Microsoft.Azure.KeyVault.KeyVaultClientExtensions.GetSecretsAsync(IKeyVaultClient operations, String vaultBaseUrl, Nullable`1 maxresults, CancellationToken cancellationToken)
   at Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.LoadAsync()
   at Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.Load()
   at Microsoft.Extensions.Configuration.ConfigurationRoot..ctor(IList`1 providers)
   at Microsoft.Extensions.Configuration.ConfigurationBuilder.Build()
   at Microsoft.AspNetCore.Hosting.WebHostBuilder.BuildCommonServices(AggregateException&amp; hostingStartupErrors)
   at Microsoft.AspNetCore.Hosting.WebHostBuilder.Build()
   at Blog.Program.BuildWebHost(String[] args) in D:\a\1\s\[csproj name]\Program.cs:line 22
   at [csproj name].Program.Main(String[] args) in D:\a\1\s\[csproj name]\Program.cs:line 16
</code></pre>

<p>I've checked that MSI_ENDPOINT and MSI_SECRET environment variables exist by calling SET from the debug console.  <a href="https://i.stack.imgur.com/km5B6.png" rel="noreferrer"><img src="https://i.stack.imgur.com/km5B6.png" alt="enter image description here"></a> </p>

<p>I can also see the KEYVAULT_ENDPOINT variable.</p>

<p>Any suggestions what could be going wrong or on what to try next? Since it works locally it must be an authentication issue, but I believe it's authenticating locally with my azure User that I've authorized in key vault, rather than as the Azure App Service. </p>
