ManagedIdentityCredential no longer works in 4.7.0 (last working version 4.3.0) with Azure ML

[sbatten]

• Package Name: @azure/identity
• Package Version: 4.7.0
• Operating system: Linux
• nodejs
  • version: 20.18.1
• browser
  • name/version:
• typescript
  • version:
• Is the bug related to documentation in
  • README.md
  • source code documentation
  • SDK API docs on https://learn.microsoft.com

Describe the bug
After upgrading, the Azure Identity package in node js to version 4.7.0 from 4.3.0, ManagedIdentityCredential no longer works in Azure ML Compute.

To Reproduce
Create a simple TS file which uses the Azure SDK packages to fetch credentials from a Key Vault. Deploy this to run in an Azure ML job which has a user assigned managed identity to the compute.

Expected behavior
Just like in 4.3.0, we can use the MI credential to fetch keys from the key vault.

Additional context

Was asked to move this issue from AzureAD/microsoft-authentication-library-for-js#7597

[KarishmaGhiya]

@sbatten Thanks for reaching out. We need more information to help you with this

1. Can you share the complete logs with us for these versions:

• 4.3.0
• 4.4.1
• 4.7.0
  To turn on logging, you can either set the env var AZURE_LOG_LEVEL to verbose OR use setLogLevel function from @azure/logger. Refer this guide - https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/TROUBLESHOOTING.md#enable-and-configure-logging

2. Can you share the complete raw request and raw response for all of these versions:

• 4.3.0
• 4.4.1
• 4.7.0
  For this you can use any tool to capture traffic that will be feasible for your scenario, like Fiddler.

[github-actions]

Hi @sbatten. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[KarishmaGhiya]

I do have the logs from Steven on this and after reviewing the logs, I understand that Azure ML machine learning MSI is not supported yet by MSAL MI implementation. The @azure/identity 4.3.0 had an in-house implementation for MSI and supported the App Service 2017 MSI, which is missing in MSAL implementation. Hence the MI fails from @azure/identity 4.4.1 onwards since we started using MSAL's MI.
We're making a feature request on MSAL to support Azure ML Managed Identity. Also MSAL will need to support both the old implementation of Azure ML which depends on App Service 2017 MSI as well as the new one which works as outlined in this issue - #27920

Until then @sbatten please use either version 4.3.0 or 4.4.0 for azure identity to get yourself unblocked. Because versions 4.4.1 onwards do not have the support currently. Also thanks for bringing this to our attention.