Function app with system assigned identity has developed issue where Keyvault references in Environment Variables no longer resolve

Question

Function app with system assigned identity has developed issue where Keyvault references in Environment Variables no longer resolve

Del Hamilton 20

I've been working with a number of function apps over the past week, most have one or more environment variable values in the format "@Microsoft.KeyVault(VaultName={my-vault-name};SecretName={secret})". After working fine all last week, today two of the functions have run into an issue where they are unable to resolve these values and therefore the function apps crash. In the Environment variables portal blade of the function app there is the error icon and Key vault link - when pressed it shows the details and OtherReasons as the issue. I have, I think, carefully compared the function with others that are working correctly and they match exactly. In the Identity blade, I checked permissions and it confirms that the identity has the role "Key Vault Secrets User" to Keyvault. In Keyvault, In Keyvault, IAM, Role assignments, the function app identity is listed with the same role as other function apps where there is no issue.

I am at a loss to understand why this has just stopped working without any changes, that I'm aware of.

Del Hamilton 20 Reputation points

2026-06-15T21:18:13.9066667+00:00

In diagnostics, for Function app down..., everything has a green tick except the last box which has an exclamation and "Uncategorized issues found" which ties in with the OtherReasons summary error.
Del Hamilton 20 Reputation points

2026-06-16T08:27:06.6266667+00:00

Hi Pravallika,

In Key Vault Application Settings Diagnostics there are errors detected but reported as Uncategorised Issues Found. When editing the Environment variables there are no errors shown, the Keyvault reference and syntax are valid and unchanged from when it was working correctly all last week.

The Entra token must be valid as it is being used to obtain a token to access the Postgres database at runtime.

Moving the secret into the env variable parameter resolves the issue but that's not a secure long term solution.

Del
Del Hamilton 20 Reputation points

2026-06-16T10:42:42.4133333+00:00

I have also disabled the managed identity and then re-enabled it to create a new identity for the function app. I assigned the role Key Vault Secrets User to the identity in Key Vault. Still the issues persists.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Samuel Crook 5 Reputation points

2026-06-16T13:00:21.9866667+00:00

We're facing the same issue, we created a key vault and started referencing it about 2 weeks ago, its been working fine since then until yesterday, it ran sucessfully at 1AM BST 15/06/26 but then failed 1AM BST 16/06/26 with no changes. We've restarted the System Assigned Identity and reallocated to Secrets User, we've tried a new version of the secret and generating new secrets. It all looks like everything should be correct, but we're getting the "OtherReasons" status on the error.

We've just tried getting the secret through a different function app that wasn't originally connected to the key vault which has worked, but then it still doesn't work for the original function app that we wanted.
Stephen A 0 Reputation points

2026-06-16T15:54:28.7366667+00:00

We've got the same issue too. 3 environments with the same setup. The function app in each environment uses Key Vault references in App Settings. At ~5am UTC on 15/06/26 key vault references stopped resolving in one of the environments with the "OtherReasons" status code. No changes have been made to them for about a week.

For context, we're using Flex consumption with user assigned identities. Everything is within a VNET. The resources all have private endpoints. Microsoft.KeyVault is enabled on all subnets.

We have:

Forced a refresh of the values by using the "Pull reference values" and changing a value name.

Checked that our networking is setup correctly

Ensured the firewall isn't blocking any communication

The UAMI has the correct roles

The UMAI is linked to the Func app both as a user assigned identity and in the keyVaultReferenceIdentity property

The secrets all exist in the KV and all have values

Created a 2nd KV and tried to resolve a value (didn't work)
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-06-18T00:27:57.56+00:00

Hi @Del Hamilton , I will reproduce the same from my end and update you.

Answer accepted by question author

Pravallika KV 18,850 Microsoft External Staff Moderator

[Updated]
Hi @Del Hamilton ,

Thanks for reaching out to Microsoft Q&A.

There was an issue in backend, and it was mitigated by Jun 18, 2026.

The Microsoft Azure Team has investigated the issue you reported regarding Key Vault reference resolution failures for your Function App in the UK South region starting on 6/16/2026. This issue was found to be related to an internal platform infrastructure inconsistency where a portion of the components responsible for resolving Key Vault references on behalf of customer applications became unavailable. The platform's routing mechanism did not detect this unavailability promptly and continued to direct resolution requests to the affected components, causing Key Vault reference resolution attempts to fail intermittently.

Upon investigation, engineers identified that the affected infrastructure components were no longer in a healthy state but had not been removed from the routing path. A targeted recovery action was performed to restore the Key Vault resolution service to full capacity in UK South, after which all Key Vault references resumed resolving successfully.

We are continuously taking steps to improve the Azure Functions service and our processes to ensure such incidents do not occur in the future, and in this case it includes (but is not limited to):

Improving health detection to automatically identify and remove unhealthy resolution components from the routing path.
Deploying additional monitoring to detect when resolution capacity drops below expected thresholds, enabling faster detection and response.
Implementing automated self-healing capabilities so the platform can recover from this class of issue without manual intervention.

We sincerely apologize for any inconvenience.

Rakesh Mishra 11,340 Reputation points Microsoft External Staff Moderator

2026-06-24T10:32:04.18+00:00

Hi @Del Hamilton , updated the comment with the updated root cause analysis. Please accept the answer as it may help other community members to understand the issue.

1 additional answer

Your answer

Del Hamilton 20 Reputation points

2026-06-15T21:18:13.9066667+00:00

In diagnostics, for Function app down..., everything has a green tick except the last box which has an exclamation and "Uncategorized issues found" which ties in with the OtherReasons summary error.
Del Hamilton 20 Reputation points

2026-06-16T08:27:06.6266667+00:00

Hi Pravallika,

In Key Vault Application Settings Diagnostics there are errors detected but reported as Uncategorised Issues Found. When editing the Environment variables there are no errors shown, the Keyvault reference and syntax are valid and unchanged from when it was working correctly all last week.

The Entra token must be valid as it is being used to obtain a token to access the Postgres database at runtime.

Moving the secret into the env variable parameter resolves the issue but that's not a secure long term solution.

Del
Del Hamilton 20 Reputation points

2026-06-16T10:42:42.4133333+00:00

I have also disabled the managed identity and then re-enabled it to create a new identity for the function app. I assigned the role Key Vault Secrets User to the identity in Key Vault. Still the issues persists.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Samuel Crook 5 Reputation points

2026-06-16T13:00:21.9866667+00:00

We're facing the same issue, we created a key vault and started referencing it about 2 weeks ago, its been working fine since then until yesterday, it ran sucessfully at 1AM BST 15/06/26 but then failed 1AM BST 16/06/26 with no changes. We've restarted the System Assigned Identity and reallocated to Secrets User, we've tried a new version of the secret and generating new secrets. It all looks like everything should be correct, but we're getting the "OtherReasons" status on the error.

We've just tried getting the secret through a different function app that wasn't originally connected to the key vault which has worked, but then it still doesn't work for the original function app that we wanted.
Stephen A 0 Reputation points

2026-06-16T15:54:28.7366667+00:00

We've got the same issue too. 3 environments with the same setup. The function app in each environment uses Key Vault references in App Settings. At ~5am UTC on 15/06/26 key vault references stopped resolving in one of the environments with the "OtherReasons" status code. No changes have been made to them for about a week.

For context, we're using Flex consumption with user assigned identities. Everything is within a VNET. The resources all have private endpoints. Microsoft.KeyVault is enabled on all subnets.

We have:

Forced a refresh of the values by using the "Pull reference values" and changing a value name.

Checked that our networking is setup correctly

Ensured the firewall isn't blocking any communication

The UAMI has the correct roles

The UMAI is linked to the Func app both as a user assigned identity and in the keyVaultReferenceIdentity property

The secrets all exist in the KV and all have values

Created a 2nd KV and tried to resolve a value (didn't work)
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-06-18T00:27:57.56+00:00

Hi @Del Hamilton , I will reproduce the same from my end and update you.
Rakesh Mishra 11,340 Reputation points Microsoft External Staff Moderator

2026-06-24T10:32:04.18+00:00

Hi @Del Hamilton , updated the comment with the updated root cause analysis. Please accept the answer as it may help other community members to understand the issue.

Answer 1

Sina Salam 31,456 Volunteer Moderator

Hello Del Hamilton,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your Function app with system assigned identity has developed issue where Key vault references in Environment Variables no longer resolve.

This is taken longer, your RBAC check is necessary but not sufficient. The fastest fix is:

Correct the reference syntax to @Microsoft.KeyVault(...) with no space.
Prefer versionless SecretUri.

Force-refresh Key Vault references using:

   az rest --method post </span> 
     --url "https://management.azure.com&lt;FUNCTION_APP_RESOURCE_ID&gt;/config/configreferences/appsettings/refresh?api-version=2022-03-01"

Restart the Function App.
Validate root cause from Key Vault SecretGet audit logs.

If the app recovers after refresh and logs show successful SecretGet, the root cause was stale/corrupt App Service Key Vault reference resolution cache, not RBAC. If it does not recover, the Key Vault logs will identify the exact failing category: 403 access/network, 404 wrong secret, disabled/expired secret version, or no platform resolution attempt due to syntax/reference state. This will both restores service and proves root cause.

Use the below resources for more reading and steps:

I hope this is helpful! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Del Hamilton 20 Reputation points

2026-06-23T14:14:25.07+00:00

Triggered to look back into the problem by Sina Salam's post, I've navigated to the affected functions and found the problem has resolved itself automatically, without any intervention from me. I can now restore the key names to their original settings, after deleting the secrets that needed to be added as a workaround.
Sina Salam 31,456 Reputation points Volunteer Moderator

2026-06-23T14:42:03.5633333+00:00

@Del Hamilton,

Thank you for letting us know that the issue's been resolved automatically after you checked back.

However, for the benefit of the community and to close this thread. Thump up any answer to close the thread.

Thank you.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-06-23T16:37:19.87+00:00

Hi @Del Hamilton , There was an issue in backend, and it was mitigated by Jun 18, 2026. The investigation for the root cause is still in progress. We will keep you posted on the root cause analysis.
Del Hamilton 20 Reputation points

2026-06-24T08:09:06.3266667+00:00

"There was an issue in backend, and it was mitigated by Jun 18, 2026. The investigation for the root cause is still in progress. We will keep you posted on the root cause analysis."

Pravallika KV
Del Hamilton 20 Reputation points

2026-06-24T08:12:08.1966667+00:00

I'm not able to mark this as the answer. Perhaps a moderator can?