Intermittent Managed Identity sidecar startup failure on Linux App Service (System-Assigned Identity)

Alex Lucero 0 Reputation points
2026-07-28T18:12:34.8666667+00:00

System-assigned Managed Identity on Linux App Service intermittently fails to start, blocking the app from acquiring any MI-based tokens (Key Vault, SQL AAD auth, etc.) on that boot.

Error observed in docker logs / StartupLogs: Site container: {app}_managedIdentity terminated during site startup.

When it fails, DefaultAzureCredential falls back to the raw IMDS endpoint (PII), which doesn't exist on App Service, producing Connection refused.

Reproduction: Created a brand-new Linux Web App (PII, DOTNETCORE:8.0, runtime image dotnetcore:8.0_20260504.4.tuxprod) with no custom code deployed — just the default hostingstart app plus System-Assigned Identity enabled. Restarted it repeatedly and observed the sidecar fail intermittently:

  • West US 3, B1 tier: ~2 failures in 8 restarts
  • West US 3, S1 tier: ~1 failure in 5 restarts (ruling out tier/resource contention)
  • West US 2, B1 tier: 1 failure in 10 restarts (ruling out region-specificity)

Ruled out on our end: VNet integration (none configured), Azure Policy (only default audit-only Security Center policy), Resource Health (reports "Available," no tracked incident).

Every failure self-recovered within ~1-2 minutes via the platform's own automatic retry

Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.