Cant Assign a custom domain to API Management

Question

Cant Assign a custom domain to API Management

Arturo Diaz 20

I keep getting erro on trying to assign a custom domain. have tried key valut and custom certificates without success. can try doing it thru portal or az and nothing works. on az i receive: (UpdateApiServiceFailed) Unable to Update API service at this time. Please check resource group deployment logs for specific errors, correct them and try again.If you are deploying into a virtual network please check the following document https://aka.ms/apimvnet for network requirements. If you still need help from support, please reach out to them.Please provide correlationId f440032c-0a20-451f-a77d-a91add9ae071 and TimeStamp 7/14/2026 5:26:52 PM.

Code: UpdateApiServiceFailed

Message: Unable to Update API service at this time. Please check resource group deployment logs for specific errors, correct them and try again.If you are deploying into a virtual network please check the following document https://aka.ms/apimvnet for network requirements. If you still need help from support, please reach out to them.Please provide correlationId f440032c-0a20-451f-a77d-a91add9ae071 and TimeStamp 7/14/2026 5:26:52 PM.. I have been fighting with this for three days now. Any help is greatly appreciated. I have already tried with different approaches. (keyvault certificates, custom certificates, etc)

Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-14T18:03:12.9+00:00

hi @Arturo Diaz

Send me the details, I have asked in the Private chat?
Arturo Diaz 20 Reputation points

2026-07-14T18:10:25.19+00:00

Thanks for the promptly response. all the points from 2 thru 5 have already been verified. you say on 6 that the APIM is on a VNet? as I remeber is not.

on the resource group on deployments, there is no infomation about the task done today.
Arturo Diaz 20 Reputation points

2026-07-17T17:04:11.7566667+00:00

Good day. any update on this issue?
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-17T20:08:52.5933333+00:00

Hi @Arturo Diaz

I checked your issue and I have escalated your issue to the backend team. I will send you an email and keep you updated on the status.
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-17T20:14:32.9233333+00:00

Hi @Arturo Diaz

I have sent you an email, I'll keep you updated on the ticket. Allow sometime for the backend team to investigate the issue.
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-17T20:38:40.78+00:00

Hi @Arturo Diaz

I have emailed you and sent a private chat with the RCA and recommendation by the backend team, Please implement the recommendation to resolve your issue.
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-20T19:16:58.5133333+00:00

Hi @Arturo Diaz The backend team said: that's correct. Customer should not need to create a TXT record. Just CNAME should be enough.

I don't see a TXT record currently present for the domain. What exactly did customer do to fix the problem? Is it possible that you didn't have the CNAME record?
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-22T19:02:09.91+00:00

Hi @Arturo Diaz

Can you please let me know the above doubt? Or am i good to close the ticket as the issue is resolved?
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-28T23:41:21.31+00:00

Hi @Arturo Diaz

I have received a below response from the product team:

You should not need to manually add this TXT record. All you should need is a CNAME record (which you already have). Its possible that you had added a TXT record for asuid.api-dev.frae.solutions at some point in the past. Perhaps you used this domain with an App Service endpoint that requires the ASUID TXT record. That TXT record became outdated and caused the problem. Its also possible that you added this domain using managed certificates which required an ASUID record due to a known bug

you should delete the TXT record and test again. We expect this to work with just the CNAME record in place. The important part is that there should be no TXT record at all for asuid.api-dev.frae.solutions to avoid the problem.

Let me know if you can do another test by deleting the TXT record.
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-30T19:01:41.0866667+00:00
Hi @Arturo Diaz

The Product Engineer said, the agent got the TXT record from the Orchestration table on the backend. But we don't expose that information to customers, and that's expected.

This error is returned in the conditions I mentioned earlier.

CNAME was deleted

A wrong TXT record was present for this domain, which would cause similar failures.

In hindsight, I wish I had checked the TXT record before suggesting to customer, but that's OK. Customer is welcome to do another test by first deleting the TXT record while ensuring CNAME is present. If it still fails, we can investigate further. You want to keep the txt record right now as it is working or want to try deleting it?

Answer accepted by question author

Siddhesh Desai 8,210 Microsoft External Staff Moderator

Hi @Arturo Diaz

Thank you for reaching out to Microsoft Q&A.

Posting this answer for the community.

As per our discussion on Private chat the issue is resolved.

Based on the investigation, the behavior is expected. The backend validation uses information from the orchestration service that is not exposed to customers. This error can occur if the CNAME record is missing or if an incorrect TXT record exists for the custom domain. In this case, it is likely that a previously configured incorrect TXT record caused the validation failure. Once the TXT record was corrected, the custom domain validation succeeded.

Resolution:

Ensure the CNAME record is configured correctly for the custom domain.
Verify that there are no stale or incorrect TXT records associated with the domain.
Since the issue is now resolved, no further action is required.
If the issue reoccurs in the future with a valid CNAME record and no conflicting TXT records, please open a new support request for further investigation.

We're glad to hear the issue has been resolved. Thank you for your patience and follow-up throughout the troubleshooting process.

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.

0 comments

1 additional answer

Your answer

Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-14T18:03:12.9+00:00

hi @Arturo Diaz

Send me the details, I have asked in the Private chat?
Arturo Diaz 20 Reputation points

2026-07-14T18:10:25.19+00:00

Thanks for the promptly response. all the points from 2 thru 5 have already been verified. you say on 6 that the APIM is on a VNet? as I remeber is not.

on the resource group on deployments, there is no infomation about the task done today.
Arturo Diaz 20 Reputation points

2026-07-17T17:04:11.7566667+00:00

Good day. any update on this issue?
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-17T20:08:52.5933333+00:00

Hi @Arturo Diaz

I checked your issue and I have escalated your issue to the backend team. I will send you an email and keep you updated on the status.
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-17T20:14:32.9233333+00:00

Hi @Arturo Diaz

I have sent you an email, I'll keep you updated on the ticket. Allow sometime for the backend team to investigate the issue.
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-17T20:38:40.78+00:00

Hi @Arturo Diaz

I have emailed you and sent a private chat with the RCA and recommendation by the backend team, Please implement the recommendation to resolve your issue.
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-20T19:16:58.5133333+00:00

Hi @Arturo Diaz The backend team said: that's correct. Customer should not need to create a TXT record. Just CNAME should be enough.

I don't see a TXT record currently present for the domain. What exactly did customer do to fix the problem? Is it possible that you didn't have the CNAME record?
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-22T19:02:09.91+00:00

Hi @Arturo Diaz

Can you please let me know the above doubt? Or am i good to close the ticket as the issue is resolved?
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-28T23:41:21.31+00:00

Hi @Arturo Diaz

I have received a below response from the product team:

You should not need to manually add this TXT record. All you should need is a CNAME record (which you already have). Its possible that you had added a TXT record for asuid.api-dev.frae.solutions at some point in the past. Perhaps you used this domain with an App Service endpoint that requires the ASUID TXT record. That TXT record became outdated and caused the problem. Its also possible that you added this domain using managed certificates which required an ASUID record due to a known bug

you should delete the TXT record and test again. We expect this to work with just the CNAME record in place. The important part is that there should be no TXT record at all for asuid.api-dev.frae.solutions to avoid the problem.

Let me know if you can do another test by deleting the TXT record.
Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-07-30T19:01:41.0866667+00:00

Hi @Arturo Diaz

The Product Engineer said, the agent got the TXT record from the Orchestration table on the backend. But we don't expose that information to customers, and that's expected.

This error is returned in the conditions I mentioned earlier.

CNAME was deleted

A wrong TXT record was present for this domain, which would cause similar failures.

In hindsight, I wish I had checked the TXT record before suggesting to customer, but that's OK. Customer is welcome to do another test by first deleting the TXT record while ensuring CNAME is present. If it still fails, we can investigate further. You want to keep the txt record right now as it is working or want to try deleting it?

Answer 1

An empty Deployments list can be expected when the change was submitted as a direct API Management control-plane update rather than an ARM deployment. Check the APIM Activity log at the failure time, filter for Microsoft.ApiManagement/service/write, and open the failed event. Match the correlation ID and capture its status JSON.

Before retrying, confirm the hostname CNAME resolves to the default APIM hostname and the PFX contains a private key, full certificate chain, and matching subject or SAN. For Key Vault, use the certificate’s secret endpoint, set its content type to application/x-pkcs12, and grant the APIM managed identity Get and List secret permissions. With a vault firewall, use the system-assigned identity and trusted-services exception.

Because both certificate paths fail and the backend team supplied an RCA, apply that recommendation first. If it still fails, return the Activity Log event, resource ID, region, UTC timestamp, and correlation ID to the existing case.