Managed identity broken for Node.js workers on Flex Consumption after host build 4.1052.300 — ManagedIdentityCredential "Network unreachable" on every new instance

Question

Managed identity broken for Node.js workers on Flex Consumption after host build 4.1052.300 — ManagedIdentityCredential "Network unreachable" on every new instance

Leo Chen 5

Our production function app suddenly lost the ability to use managed identity, and I'm fairly sure an Azure host update caused it. The app runs on the Flex Consumption plan (Node.js 20, Central US) and uses DefaultAzureCredential in code to get tokens for PostgreSQL and Key Vault. Starting around 01:30 UTC on Aug 5, every token request on newly created instances fails immediately with ManagedIdentityCredential: Network unreachable (msal.js network_error).

The failures line up perfectly with a Functions host build change. Instances running host 4.1052.200.26352 all work — including a dev copy of the same app in another region that spun up 58 fresh instances yesterday without a single error. Instances on the newer 4.1052.300.26370 fail 100% of the time. Our Python function app in the same subscription and region is already on the new build and gets tokens from code just fine, and platform-level identity still works everywhere.

We changed nothing on our side — no deploys around the onset, no config or permission changes, no dependency updates, no VNet. Restarting and a full stop/start didn't help since every new instance lands on the new build — and Flex Consumption doesn't let you pin the runtime version. Has anyone else hit this on host 4.1052.300.x with Node on Flex?

0 comments

2 answers

Your answer

Answer 1

Hi @Leo Chen ,

Thanks for reaching out to Microsoft Q&A.

ManagedIdentityCredential: Network unreachable occurring only on newly created Flex Consumption instances after the host build change, while older host builds and another region continue to function correctly this appears to indicate a runtime managed identity endpoint/connectivity issue rather than a problem with your application code or managed identity permissions.

We engaged Product team to investigate this issue and here's the analysis we received:

A regression in the Azure Functions host build 4.1052.300 caused managed identity token requests to fail on every new Node.js worker instance in Flex Consumption. The worker process lacked the required environment variables, causing fallback to an unsupported metadata address and network unreachable errors. Python workers were unaffected. The issue was isolated to the Node.js image which regressed from Node 20 to Node 18. The problem caused critical application failures impacting messaging and database APIs. The incident was escalated and mitigated by rolling back to the last known good image.

Managed identity token requests fail on new Node.js instances due to network connectivity issues with the local identity endpoint.

Solution:

The backend team mitigated the issue by rolling back to the previous host build image (4.1052.200)** **to restore managed identity functionality on Node.js workers.

A defective host build image (4.1052.300) regressed the Node.js runtime from Node 20 to Node 18, causing managed identity environment variables to be missing and token requests to fail on new instances. Hope this helps!

If the resolution was helpful, kindly take a moment to click on User's image and click on Yes for was this answer helpful. And, if you have any further query do let us know.

Andrew Challen 0 Reputation points

2026-08-12T08:22:47.7333333+00:00

I had the same it's related to this https://learn.microsoft.com/en-us/answers/questions/5966718/azure-functions-host-4-1052-300-26370-breaks-node

Upgrading the runtime to NODE|24 from NODE|20 has fixed the problem for me.

Answer 2

Carry Hopper 0

Likely a platform-side regression in host build 4.1052.300 affecting Node.js MI token requests on Flex Consumption.

since you can't pin the host version, open an Azure support ticket citing the build numbers; a temporary workaround is fetching tokens via the IDENTITY_ENDPOINT/IDENTITY_HEADER env vars directly with axios instead of Default Azure Credential.

0 comments