# \[v8.17.6\] Azure Managed Identity Not Working – CredentialUnavailableException **URL:** \ **Category:** Elasticsearch\ **Tags:** snapshot-and-restore\ **Created:** [July 22, 2025, 9:40am UTC](https://discuss.elastic.co/t/v8-17-6-azure-managed-identity-not-working-credentialunavailableexception/380335 "2025-07-22T09:40:07Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![kshanuy](https://avatars.discourse-cdn.com/v4/letter/k/9dc877/32.png) [@kshanuy](https://discuss.elastic.co/u/kshanuy)\ **Post date:** [July 22, 2025, 9:40am UTC](https://discuss.elastic.co/t/v8-17-6-azure-managed-identity-not-working-credentialunavailableexception/380335/1 "2025-07-22T09:40:07Z")
We are trying to use **User Assigned Managed Identity (UAMI)** for snapshot repository authentication on **Elasticsearch v8.17.6** running on **Azure Virtual Machines Scale Set (Windows VM)**. We followed the official docs: > [https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-azure.html](https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-azure.html) > [https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-azure-client.html](https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-azure-client.html) Managed Identity is assigned to the VM and has **Storage Blob Data Contributor** access to the storage account. However, we are getting the following error when trying to access the snapshot repository: ```auto "reason": "credential_unavailable_exception: EnvironmentCredential authentication unavailable. Environment variables are not fully configured... Managed Identity authentication is not available. ... Azure Powershell authentication failed. Error Details: access denied (\"java.io.FilePermission\" \"<>\" \"execute\")" ``` ```auto "POST "https://localhost:9200/_snapshot/elasticsearch-snapshots/_verify?pretty" -k { "error" : { "root_cause" : [ { "type" : "credential_unavailable_exception", "reason" : "credential_unavailable_exception: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/environmentcredential/troubleshoot\r\nWorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/java/identity/workloadidentitycredential/troubleshoot\r\nManaged Identity authentication is not available.\r\nSharedTokenCacheCredential authentication unavailable. No accounts were found in the cache.\r\naccess denied (\"java.io.FilePermission\" \"C:\\Windows\\system32\\config\\systemprofile\\AzureToolsForIntelliJ\\AuthMethodDetails.json\" \"read\")\r\naccess denied (\"java.io.FilePermission\" \"<>\" \"execute\")\r\nAzure Powershell authentication failed. Error Details: access denied (\"java.io.FilePermission\" \"<>\" \"execute\"). To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/powershellcredential/troubleshoot\r\naccess denied (\"java.io.FilePermission\" \"<>\" \"execute\")To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azure-identity-java-default-azure-credential-troubleshoot", "suppressed" : [ { "type" : "exception", "reason" : "exception: #block terminated with an error" } ] } ], "type" : "repository_verification_exception", "reason" : "[elasticsearch-snapshots] path [elasticsearch-snapshots] is not accessible on master node", "caused_by" : { "type" : "credential_unavailable_exception", "reason" : "credential_unavailable_exception: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/environmentcredential/troubleshoot\r\nWorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/java/identity/workloadidentitycredential/troubleshoot\r\nManaged Identity authentication is not available.\r\nSharedTokenCacheCredential authentication unavailable. No accounts were found in the cache.\r\naccess denied (\"java.io.FilePermission\" \"C:\\Windows\\system32\\config\\systemprofile\\AzureToolsForIntelliJ\\AuthMethodDetails.json\" \"read\")\r\naccess denied (\"java.io.FilePermission\" \"<>\" \"execute\")\r\nAzure Powershell authentication failed. Error Details: access denied (\"java.io.FilePermission\" \"<>\" \"execute\"). To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/powershellcredential/troubleshoot\r\naccess denied (\"java.io.FilePermission\" \"<>\" \"execute\")To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azure-identity-java-default-azure-credential-troubleshoot", "suppressed" : [ { "type" : "exception", "reason" : "exception: #block terminated with an error" } ] } }, "status" : 500 } " ``` ✅ Things we tried: - We can successfully fetch the token manually via: - Verified network access to storage container. - Added the correct `elasticsearch.yml` config: - Tried with and without `azure.client.default.managed_identity = true` (it’s not documented). - Plugin is bundled, no extra install. ❓ Questions: 1. Is there an example of **working Managed Identity (MSI) config** on Windows VMs for snapshot repo? 2. Is there a known issue with the **DefaultAzureCredential chain** inside Elasticsearch on **Windows**? 3. Should we instead pass the token manually using `elasticsearch-keystore add-file azure.client.default.token_file`? Any guidance would be appreciated! ---
**Author:** ![Rafa\_Silva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafa_silva/32/147814_2.png) [@Rafa\_Silva](https://discuss.elastic.co/u/Rafa_Silva)\ **Post date:** [July 22, 2025, 11:40am UTC](https://discuss.elastic.co/t/v8-17-6-azure-managed-identity-not-working-credentialunavailableexception/380335/2 "2025-07-22T11:40:57Z")
Thanks for sharing all the details that helps a lot. Here’s a quick run-through of what I see: 1. Working config on Windows VMs? There aren’t many public examples for UAMI on Windows VMs, but your setup looks mostly correct. You only need: azure.client.default.account: azure.client.default.endpoint\_suffix: [core.windows.net](http://core.windows.net) No need to set azure.client.default.managed\_identity = true the plugin uses DefaultAzureCredential, which already tries Managed Identity under the hood. 1. Known issues on Windows? Yes, and your error log points right to them. On Windows, some parts of the DefaultAzureCredential chain (like EnvironmentCredential and AzurePowerShellCredential) can fail due to file system restrictions or missing env vars. In many cases, the SDK doesn’t cleanly skip over these failures, so the Managed Identity part doesn’t even get a chance to run. This is especially true when Elasticsearch runs as a service under systemprofile, which has very limited permissions. 1. Manual token via keystore? Yes that’s a solid workaround. Since you can already get the token manually from IMDS, you can save it and use: elasticsearch-keystore add-file azure.client.default.token\_file /path/to/token.json Just make sure the file has the correct structure (with "access\_token"), and keep in mind the token expires every hour so you’d need a script to refresh and reload it periodically. ---
**Author:** ![kshanuy](https://avatars.discourse-cdn.com/v4/letter/k/9dc877/32.png) [@kshanuy](https://discuss.elastic.co/u/kshanuy)\ **Post date:** [July 24, 2025, 7:15am UTC](https://discuss.elastic.co/t/v8-17-6-azure-managed-identity-not-working-credentialunavailableexception/380335/3 "2025-07-24T07:15:53Z")
Tried workaround getting this error: ```auto java.lang.IllegalArgumentException: unknown secure setting [azure.client.default.token_file] please check that any required plugins are installed, or check the breaking changes documentation for removed settings at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:564) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:510) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:480) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:450) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.common.settings.SettingsModule.(SettingsModule.java:133) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.common.settings.SettingsModule.(SettingsModule.java:51) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.node.NodeConstruction.validateSettings(NodeConstruction.java:530) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.node.NodeConstruction.prepareConstruction(NodeConstruction.java:280) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.node.Node.(Node.java:200) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.bootstrap.Elasticsearch$2.(Elasticsearch.java:247) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.bootstrap.Elasticsearch.initPhase3(Elasticsearch.java:247) ~[elasticsearch-8.17.6.jar:?] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:76) ~[elasticsearch-8.17.6.jar:?] ``` ---
**Author:** ![Rafa\_Silva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafa_silva/32/147814_2.png) [@Rafa\_Silva](https://discuss.elastic.co/u/Rafa_Silva)\ **Post date:** [August 12, 2025, 2:05pm UTC](https://discuss.elastic.co/t/v8-17-6-azure-managed-identity-not-working-credentialunavailableexception/380335/4 "2025-08-12T14:05:49Z")
> [@kshanuy](#): > > ```auto > java.lang.IllegalArgumentException: unknown secure setting [azure.client.default.token_file] please check that any required plugins are installed, or check the breaking changes documentation for removed settings > at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:564) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:510) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:480) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:450) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.common.settings.SettingsModule.(SettingsModule.java:133) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.common.settings.SettingsModule.(SettingsModule.java:51) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.node.NodeConstruction.validateSettings(NodeConstruction.java:530) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.node.NodeConstruction.prepareConstruction(NodeConstruction.java:280) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.node.Node.(Node.java:200) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.bootstrap.Elasticsearch$2.(Elasticsearch.java:247) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.bootstrap.Elasticsearch.initPhase3(Elasticsearch.java:247) ~[elasticsearch-8.17.6.jar:?] > at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:76) ~[elasticsearch-8.17.6.jar:?] > > ``` Thanks for the update — that error makes it clear. `azure.client.default.token_file` isn’t a valid setting. It’s not supported by the Azure repository plugin in 8.17.6, so that approach won’t work. If you’re using User Assigned Managed Identity, try setting this environment variable on the VM: ```auto AZURE_CLIENT_ID= ``` Make sure no other Azure-related env vars are set that could interfere. This will force the SDK to use your UAMI directly. If that still fails, the fallback is to use a storage account access key via: ```auto elasticsearch-keystore add azure.client.default.account elasticsearch-keystore add azure.client.default.key ``` Let me know how it goes.