App Service container Web App — managed identity attached but IDENTITY_ENDPOINT env var missing; ACRTokenRetrievalFailure on image pull (works in publisher tenant, fails in customer's Managed Application managed RG)

Hello Pratik Tiwale

Greetings! Thanks for raising this question in Q&A forum.

This is a very nuanced scenario and you've done excellent detective work already. Let me explain exactly what's happening and walk you through the fixes step by step.

The core issue here is a combination of two things. First, when a Web App is deployed via a Marketplace Managed Application into a customer's managed resource group, the App Service platform's managed identity sidecar which injects IDENTITY_ENDPOINT sometimes fails to initialize correctly during first-time provisioning in a cross-tenant context. The platform needs a restart signal to properly wire up the MSI endpoints after the identity is attached. Second, and more importantly, your ACR lives in your publisher tenant while the Web App runs in the customer's tenant managed identities are scoped to a single Microsoft Entra ID tenant and cannot be granted access to resources that exist in another tenant. This is the fundamental blocker for the ACRTokenRetrievalFailure.

Here is how to address each part:

Step 1: Confirm IDENTITY_ENDPOINT injection by triggering a fresh restart After the Bicep deployment completes, the managed identity sidecar may not be fully initialized. Add a post-deployment step in your Bicep or deployment pipeline to explicitly restart the Web App:

az webapp restart --name <webapp-name> --resource-group <managed-rg>

Then open Kudu (go to your Web App > Advanced Tools > Go) and check the environment variables under the Environment tab. Confirm that IDENTITY_ENDPOINT and IDENTITY_HEADER are now present. If IDENTITY_ENDPOINT is still not set after restart, test token acquisition directly from Kudu console using curl "$IDENTITY_ENDPOINT?resource=https://management.azure.com&api-version=2019-08-01" -H "X-IDENTITY-HEADER: $IDENTITY_HEADER" — if this returns a valid token, the managed identity is working and the problem lies elsewhere.

Step 2: Explicitly set acrUserManagedIdentityID in your Bicep This is a common and easily missed configuration. Make sure your configuration explicitly instructs App Service to use the UAMI for ACR pulls by setting both acrUseManagedIdentityCreds = true and acrUserManagedIdentityID = <clientId-of-UAMI>. If this setting is absent or configured incorrectly, the platform will default to the system-assigned identity, which will result in the pull operation failing.

In your Bicep, under siteConfig, it should look like this:

acrUseManagedIdentityCreds: true
acrUserManagedIdentityID: uami.properties.clientId

Step 3: Address the real cross-tenant blocker — your ACR is in the publisher tenant This is the root cause of why it works in your publisher tenant but fails in the customer's. The UAMI in the customer's managed RG cannot pull from your publisher-tenant ACR because managed identities are tenant-scoped. Here are your two recommended options:

Option A — Use ACR token-based pull secret (recommended for Marketplace scenarios) Create a scoped ACR token with pull-only access in your publisher ACR, and pass it as a Docker registry credential. Store it securely in a Key Vault in the managed RG, and reference it as an app setting. This avoids cross-tenant identity entirely and is the most reliable pattern for Marketplace-deployed apps pulling from a publisher-owned ACR. Since Entra IDs are tenant-scoped, it is not possible to assign an identity from the publisher tenant to the resource deployed in the customer tenant — creating a scoped App Registration with pull access and using its credentials is a practical and low-risk workaround for this scenario.

Option B — Mirror the image into a customer-side ACR As part of your Managed Application deployment, provision an ACR in the customer's managed RG and use an az acr import step or an image-copy pipeline to pull the image from your publisher ACR into the customer's ACR. The UAMI in the customer's managed RG can then pull from the customer-side ACR without any cross-tenant issues.

Step 4: Verify the UAMI client ID is correctly resolved in Bicep A common Bicep pitfall in Managed Application deployments is that the UAMI resource reference is not fully resolved at deployment time. Make sure your Bicep uses a reference() or a dependsOn to ensure the UAMI exists before the Web App is created, and that you're passing uami.properties.clientId (not principalId) to acrUserManagedIdentityID.

Step 5: Check Entra Sign-in Logs for the UAMI's service principal in the customer tenant Go to the customer's Entra admin center > Sign-in Logs > filter by the UAMI's service principal (the one you verified exists via az ad sp show). Look at the timestamp when the container pull fails. Any token acquisition errors will surface here with specific error codes that pinpoint whether it's an audience mismatch, a permission issue, or a token endpoint connectivity problem.

Step 6: Open a support ticket if the IDENTITY_ENDPOINT injection issue persists If after a clean redeploy and restart the IDENTITY_ENDPOINT is still not injected in the customer's managed RG, this may be a platform-level initialization bug specific to Managed Applications on Linux container Web Apps. Raise a Technical support ticket with Azure App Service, provide the managed application resource ID, the managed RG name, and the Web App resource ID, and request the App Service backend team to investigate the MSI sidecar initialization for this deployment pattern.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.