Login failed for user '<token-identified principal>' (I have spent many hours exhausting options)

Hi @Jonathon Childs

Based on your scenario, please validate the following:

1. Correct database context Ensure the connection is targeting the intended database (not master), as contained users must exist in the specific database.
2. User exists and SID matches

SELECT name, type_desc, 
       CONVERT(uniqueidentifier, sid) AS ObjectId
FROM sys.database_principals
WHERE name = '<identity_name>';

Confirm the ObjectId matches the Managed Identity Object ID.

1. Important: App Service slot identities Each deployment slot has a separate Managed Identity (different Object ID). If the test slot is being used, ensure the database user was created for that specific identity — not just the parent app.
2. Recreate user if needed If there is any mismatch or uncertainty:

DROP USER [<identity_name>];
CREATE USER [<identity_name>] FROM EXTERNAL PROVIDER;

Given that production works and only the test slot fails, a mismatch in the identity (especially slot-specific) or stale user mapping is the most likely cause.