Managed Identity (VM) access to SharePoint Online with Federated Credentials

Hi @Brennan Phoenix

Thank you for posting your question in the Microsoft Q&A forum. 

Based on your description, the issue appears to occur before SharePoint authorization, during the Managed Identity > Federated Credential > Entra application token exchange process, rather than within SharePoint or Sites.Selected permissions.  

Federated identity credentials validate specific claims from the incoming Managed Identity token, including issuer (iss), subject (sub), and audience (aud). If those claims do not match the configured federated credential, Microsoft Entra ID will reject the token exchange request, even though the federated credential object, Managed Identity assignment, and SharePoint (Sites.Selected) permissions remain unchanged. 

This strict claim validation is part of the workload identity federation security model.  

If the claims presented in the token differ from what the federated credential expects, for example due to identity recreation, scope changes, or validation updates, authentication can fail even when no obvious configuration changes were made.  

Here are some steps you may try: 

-Remove the existing federated identity credential from the App Registration (not from the Managed Identity object). 

-Recreate the federated credential using the VM’s Managed Identity to ensure the trust configuration aligns with the current token claims. 

-Review Entra sign-in logs for AADSTS errors related to token exchange or workload identity federation. 

-If deterministic stability is required, certificate-based authentication remains a mature alternative. Certificates use the OAuth 2.0 client credentials flow directly and do not depend on workload identity federation, which explains why certificate authentication continues to work as a fallback.  

Reference: Overview of federated identity credentials in Microsoft Entra ID - Microsoft Graph v1.0 | Microsoft… 

I hope this information is helpful. 

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

There are a few potential reasons why the Managed Identity authenticating via Federated Credentials might have suddenly stopped working:

1. Propagation Delay: Changes to federated identity credentials can take time to propagate throughout the Azure environment. If there were any recent changes made to the federated identity configuration, it may take a while for those changes to be fully recognized across all nodes of the authorization service. During this time, token requests may fail due to outdated cached data. It is recommended to wait a short time after making changes before requesting a token and to implement retry logic for token requests to handle temporary failures.
2. Token Caching Issues: If the token request was made shortly after the federated identity credential was configured or modified, it could have resulted in the error AADSTS70021: No matching federated identity record found for presented assertion. This suggests that the cache was not yet updated with the new information.
3. Permissions and Role Assignments: Even though you confirmed that the API permissions and write permissions are still present, ensure that the managed identity still has the necessary role assignments on the SharePoint site. Sometimes, permissions can be inadvertently altered or revoked.
4. Service Principal Issues: Verify that the service principal associated with the managed identity is still valid and has not been deleted or disabled. Any issues with the service principal could prevent successful authentication.
5. Environment Changes: Although you mentioned that no changes were made to the application or its IIS environment, double-check for any updates or changes in the Azure environment or policies that might affect authentication.

If these areas have been thoroughly checked and the issue persists, it may be beneficial to consult Azure support for further investigation into the managed identity and federated credential configuration.

References:

• Time for federated credential changes to propagate
• Configure a federated identity credential on an application