com.ntrs.wpa.azure.redis.exception.AzureRedisAuthenticationException: Failed to acquire Azure Redis access token

Given the checks already completed, the remaining supported causes are:

1. Verify workload identity environment configuration in the app. WorkloadIdentityCredential requires all of these values to be present and correct:
   • AZURE_CLIENT_ID
   • AZURE_TENANT_ID
   • AZURE_FEDERATED_TOKEN_FILE
   • AZURE_AUTHORITY_HOST
   If any of these are missing, the credential can fail with: WorkloadIdentityCredential authentication unavailable. The workload options aren't fully configured.
2. Validate the Redis connection end to end from Azure CLI. Run:

      az redisenterprise test-connection --name <cache-name> --resource-group <resource-group-name> --auth entra
   

   This verifies connectivity by sending a ping and uses the credential established through az login.
3. Confirm the identity is added as a Redis user, not only granted management access. Azure Managed Redis requires Microsoft Entra users or service principals to be added to the Redis users list. Microsoft Entra groups aren't supported.
4. If the application is using .NET with StackExchange.Redis, check the client library implementation. A documented case with successful token generation and correct Redis permissions still failed because the application used an incompatible implementation. The issue was resolved by replacing the existing implementation with Microsoft.Azure.StackExchangeRedis.
5. If the failure is specifically in token acquisition inside the hosted environment, verify the workload identity token file path and mounted token file are the same path referenced by AZURE_FEDERATED_TOKEN_FILE.
6. If the app is using managed identity instead of workload identity at runtime, verify the managed identity endpoint is reachable. On a VM, IMDS can be tested with:

      curl 'http://169.254.169.254/metadata/identity/oauth2/token?resource=https://management.core.windows.net&api-version=2018-02-01' -H "Metadata: true"
   

   Warning: this returns a valid access token. Do not share the token.
7. If the application reaches Redis but authentication still fails, check for these Redis-specific symptoms:
   • AuthenticationFailedException: refresh credentials with az login and verify the identity is added as a Redis user under Authentication.
   • Unauthorized: ensure the Microsoft Entra ID identity is added as a Redis user on the Azure Managed Redis instance.
   • No connection is available: verify endpoint format and port 10000, and confirm the Redis instance is provisioned and accessible.

• Use Microsoft Entra ID for cache authentication with Azure Managed Redis
• Troubleshoot Azure-hosted application authentication
• Secure your Azure Managed Redis deployment
• Azure Managed Redis sample - ASP.NET Core Web API
• Getting authentication error even after providing identity access for authenticating to Azure Redis Cache - Microsoft Q&A
• Troubleshoot Azure-hosted application authentication