Skip to content

Update mi test mi for region lock sfi #5538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
+17 −18
Open

Update mi test mi for region lock sfi #5538

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
10c45e1
Update managed identity references to new MI
RyAuld Oct 16, 2025
93d9cd2
Consolidate Key Vault UAMI into main UAMI
RyAuld Oct 17, 2025
529ff1f
Fix E2E IMDS tests to use ID4SMSIHostedAgent pool's managed identity
RyAuld Oct 20, 2025
0aa48a9
Fix SAMI test to specify client ID when multiple UAMIs exist
RyAuld Oct 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions tests/Microsoft.Identity.Test.E2e/ManagedIdentityImdsTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,11 +37,11 @@ private static IManagedIdentityApplication BuildMi(
[RunOnAzureDevOps]
[TestCategory("MI_E2E_Imds")]
[DataTestMethod]
[DataRow(null /*SAMI*/, null, DisplayName = "SAMI")]
[DataRow("4b7a4b0b-ecb2-409e-879a-1e21a15ddaf6", "clientid", DisplayName = "UAMI-ClientId")]
[DataRow("/subscriptions/c1686c51-b717-4fe0-9af3-24a20a41fb0c/resourcegroups/MSAL_MSI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/LabVaultAccess_UAMI",
[DataRow("8ef2ae5a-f349-4d36-bc0e-a567f2cc50f7", "clientid", DisplayName = "SAMI-as-UAMI")]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to pass null here so we can test SAMI.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I ran into the issue below when using Null and having Multiple resources assigned. Is there a way to specify without breaking the null test?

Managed Identity E2E Test Pool Configuration Issue
Problem: The ID4SMSIHostedAgent pool had multiple User Assigned Managed Identities (UAMIs) configured:

Legacy cross-subscription LabVaultAccess_UAMI (4b7a4b0b-ecb2-409e-879a-1e21a15ddaf6)
New local ID4SMSIHostedAgent_UAMI (8ef2ae5a-f349-4d36-bc0e-a567f2cc50f7)
Error: When the E2E test attempted to use System Assigned Managed Identity (SAMI) with null client ID, the Azure IMDS service returned:

Status: BadRequest
"Multiple user assigned identities exist, please specify the clientId / resourceId of the identity in the token request"

Root Cause: Azure's Instance Metadata Service (IMDS) requires explicit identity specification when multiple UAMIs are assigned to a resource. The test's SAMI approach (using null/default) became ambiguous.

Solution: Modified the E2E test to explicitly specify the local UAMI's client ID (8ef2ae5a-f349-4d36-bc0e-a567f2cc50f7) instead of relying on default SAMI behavior.

Why This Approach:

Maintains backward compatibility for main branch builds that depend on the legacy UAMI
Avoids infrastructure changes that could impact other test pools or pipelines
Provides explicit identity specification, eliminating ambiguity
Ensures all test cases use the correct local UAMI that the pool has proper access to

[DataRow("8ef2ae5a-f349-4d36-bc0e-a567f2cc50f7", "clientid", DisplayName = "UAMI-ClientId")]
[DataRow("/subscriptions/6f52c299-a200-4fe1-8822-a3b61cf1f931/resourcegroups/DevOpsHostedAgents/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID4SMSIHostedAgent_UAMI",
"resourceid", DisplayName = "UAMI-ResourceId")]
[DataRow("1eee55b7-168a-46be-8d19-30e830ee9611", "objectid", DisplayName = "UAMI-ObjectId")]
[DataRow("0651a6fc-fbf5-4904-9e48-16f63ec1f2b1", "objectid", DisplayName = "UAMI-ObjectId")]
public async Task AcquireToken_OnImds_Succeeds(string id, string idType)
{
var mi = BuildMi(id, idType);
Expand Down
15 changes: 7 additions & 8 deletions .../Microsoft.Identity.Test.Integration.netcore/HeadlessTests/ManagedIdentityTests.NetFwk.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,14 +36,13 @@ public class ManagedIdentityTests
//http proxy base URL
private static readonly string s_baseURL = "https://service.msidlab.com/";

//Shared User Assigned Client ID
private const string UserAssignedClientID = "3b57c42c-3201-4295-ae27-d6baec5b7027";
//Shared User Assigned Client ID - Consolidated UAMI for both MSI endpoints and Key Vault access
private const string UserAssignedClientID = "45344e7d-c562-4be6-868f-18dac789c021";

//Lab Access Client ID for certificate-based authentication to lab resources
private const string LabAccessClientID = "f62c5ae3-bf3a-4af5-afa8-a68b800396e9";

private const string LabVaultAccessUserAssignedClientID = "4b7a4b0b-ecb2-409e-879a-1e21a15ddaf6";

private const string UserAssignedObjectID = "9fc6a41b-e161-43ba-90ba-12f172141c23";
private const string UserAssignedObjectID = "a38637b6-b365-4652-af1f-cf5d8cf829ad";

//Non Existent User Assigned Client/Object ID
private const string SomeRandomGuid = "f07359bb-f4f6-4e3c-ba9f-ccdf48eb80ce";
Expand All @@ -55,7 +54,7 @@ public class ManagedIdentityTests
//Resource ID of the User Assigned Identity
private const string UamiResourceId = "/subscriptions/c1686c51-b717-4fe0-9af3-24a20a41fb0c/" +
"resourcegroups/MSAL_MSI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/" +
"MSAL_MSI_USERID";
"Msal_Integration_tests";

//non existent Resource ID of the User Assigned Identity
private const string Non_Existent_UamiResourceId = "/subscriptions/userAssignedIdentities/NO_ID";
Expand Down Expand Up @@ -191,8 +190,8 @@ public async Task AcquireMsiToken_ExchangeForEstsToken_Successfully()
string uri = s_baseURL + $"MSIToken?" +
$"azureresource={MsiAzureResource.WebApp}&uri=";

//Create CCA with Proxy
IManagedIdentityApplication mia = CreateMIAWithProxy(uri, LabVaultAccessUserAssignedClientID, UserAssignedIdentityId.ClientId);
//Create CCA with Proxy - using the consolidated UAMI for both MSI and Key Vault access
IManagedIdentityApplication mia = CreateMIAWithProxy(uri, UserAssignedClientID, UserAssignedIdentityId.ClientId);

AuthenticationResult result;
//Act
Expand Down
12 changes: 6 additions & 6 deletions tests/devapps/Managed Identity apps/MSIHelperService/readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,7 +186,7 @@ Build the current project (The MSI Helper Service - MSIHelperService.csproj) and

## User Assigned Identity

This helper service also exposes the [User Identity](https://ms.portal.azure.com/#@microsoft.onmicrosoft.com/resource/subscriptions/c1686c51-b717-4fe0-9af3-24a20a41fb0c/resourceGroups/MSAL_MSI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/MSAL_MSI_USERID/overview) for testing.
This helper service also exposes the [User Identity](https://ms.portal.azure.com/#@microsoft.onmicrosoft.com/resource/subscriptions/c1686c51-b717-4fe0-9af3-24a20a41fb0c/resourceGroups/MSAL_MSI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/Msal_Integration_tests/overview) for testing.

<br>
<img src="images/uid.PNG" alt="uid" width="800"/>
Expand All @@ -197,13 +197,13 @@ Following are some useful information to test the User Identity.

| Syntax | Description |
| ----------- | ----------- |
| Resource ID | /subscriptions/c1686c51-b717-4fe0-9af3-24a20a41fb0c/resourcegroups/MSAL_MSI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/MSAL_MSI_USERID |
| Name | MSAL_MSI_USERID |
| Resource ID | /subscriptions/c1686c51-b717-4fe0-9af3-24a20a41fb0c/resourcegroups/MSAL_MSI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/Msal_Integration_tests |
| Name | Msal_Integration_tests |
| Type | Microsoft.ManagedIdentity/userAssignedIdentities |
| Location | eastus2 |
| Location | eastus |
| Tenant Id | 72f988bf-86f1-41af-91ab-2d7cd011db47 |
| Principal Id | 3b57c42c-3201-4295-ae27-d6baec5b7027 |
| Client Id | 3b57c42c-3201-4295-ae27-d6baec5b7027 |
| Principal Id | a38637b6-b365-4652-af1f-cf5d8cf829ad |
| Client Id | 45344e7d-c562-4be6-868f-18dac789c021 |

# Troubleshooting the test service

Expand Down
Loading