Azure Key Vault Access from Azure Arc Host

Every Azure Arc–enabled server automatically has a system-assigned managed identity created when it's onboarded. The Connected Machine agent (HIMDS) on Arc exposes a local IMDS-style endpoint (by default http://localhost:40342) and sets environment variables like IDENTITY_ENDPOINT and IMDS_ENDPOINT. Workloads use this to request tokens. On Windows, only local Administrators or members of the Hybrid agent extension applications local group can complete the HIMDS challenge and retrieve tokens. By default, an IIS app pool identity won't have access.

When you use Azure CLI as an admin, you can read the HIMDS challenge and get a token. The IIS worker process, running under its own low-privilege identity, usually cannot — so the token request fails and your app can't access Key Vault.

To fix this, try the following:

1. Confirm the Arc machine identity

      az connectedmachine show --name MyMachine --resource-group MyRG --query identity -o json
   

   This shows the managed identity's principal ID.
2. Grant the Arc identity access to Key Vault
   • RBAC (recommended):

          az role assignment create \
            --assignee <principalId> \
            --role "Key Vault Secrets User" \
            --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/<vaultName>
     

   • Or with an access policy:

          az keyvault set-policy --name <vaultName> --object-id <principalId> --secret-permissions get list
     

3. Check the local identity endpoint on the server

      $env:IDENTITY_ENDPOINT
      $env:IMDS_ENDPOINT
   

   You can also try a token request:

      Invoke-WebRequest -Uri "$env:IDENTITY_ENDPOINT?api-version=2018-02-01&resource=https://vault.azure.net" -Headers @{Metadata='true'}
   

4. Allow IIS to use HIMDS Add the IIS app pool identity (or its service account) to the Hybrid agent extension applications local group:

      Add-LocalGroupMember -Group "Hybrid agent extension applications" -Member "CONTOSO\svc-iis-app"
   

   Then recycle the app pool or restart IIS.
5. Use the Azure SDK in your app In .NET, for example:

      var client = new Azure.Security.KeyVault.Secrets.SecretClient(
          new Uri("https://<your-kv>.vault.azure.net/"),
          new DefaultAzureCredential());
   
      var secret = await client.GetSecretAsync("MySecret");
   

   Make sure you're using a recent version of the Azure.Identity library.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin