An App Service-hosted .NET API uses managed identity for Azure SQL, but login fails in production. How would you debug it?

Debug managed identity login failures to Azure SQL

Diagnose a .NET API that cannot connect to Azure SQL using managed identity.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I separate three boundaries. First, I verify that the app is using a supported Microsoft Entra path: SqlClient may acquire managed-identity credentials from connection-string authentication, or the application may acquire and supply an access token explicitly. Second, I confirm Azure SQL has a user for the actual system- or user-assigned identity with the required permissions. Third, I check firewall, private endpoint, DNS, and VNet routing. The exact login or connection error tells me which boundary to investigate first.

Full answer below

Practice focus

Managed identity assignment, SQL user mapping, connection string authentication mode, firewall/private endpoint access, and runtime permissions.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Managed identity login to Azure SQL crosses token acquisition, network reachability, database user mapping, and authorization. Separating those layers prevents a permission problem from being treated as a connection problem or vice versa.
I separate three boundaries. First, I verify that the app is using a supported Microsoft Entra path: SqlClient may acquire managed-identity credentials from connection-string authentication, or the application may acquire and supply an access token explicitly. Second, I confirm Azure SQL has a user for the actual system- or user-assigned identity with the required permissions. Third, I check firewall, private endpoint, DNS, and VNet routing. The exact login or connection error tells me which boundary to investigate first.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would separate identity acquisition from database permission. The app may acquire a token successfully and still fail because the database user does not exist or lacks rights. It may also have correct database rights but fail before SQL because network rules block the connection. For EF Core, I would check whether the runtime path and migration path use different identities or permissions. Runtime access can be least privilege, while migrations may need a separate controlled identity. I would prove the fix with a small production-safe connectivity check rather than assuming the next user request will tell me.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Creating a managed identity but never creating a database user for it.
Using the wrong identity in staging versus production.
Fixing runtime access by granting broad database owner permissions.
Ignoring firewall or private endpoint rules.

An App Service-hosted .NET API uses managed identity for Azure SQL, but login fails in production. How would you debug it?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue the section

Technologies

Tech stacks

Skill areas

Was this drill useful?

Found this answer useful?

Human editorial direction

An App Service-hosted .NET API uses managed identity for Azure SQL, but login fails in production. How would you debug it?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue the section

Technologies

Tech stacks

Skill areas

Start a conversation

Was this drill useful?

Found this answer useful?

Human editorial direction