title: DefaultAzureCredential fails for AzureAppConfiguration but works for SecretClient when running locally
body: <p>I am trying to use Managed Identity for both <em>Azure Key Vault</em> and <em>Azure App Config</em>.</p>
  <p>The following code works when I deploy to my Azure App Service - but when I run locally the SecretClient code succeeds and the AppConfig code fails.</p>
  <p>For my KeyVault I've tried using <em>Vault access policy</em> and RBAC - and both work. I added myself and the App Service as <em>Key Vault Secrets User</em> role.</p>
  <p>For my AppConfig I have added myself to RBAC as <em>App Configuration Data Owner</em>, and my App Service as <em>App Configuration Data Reader</em>. Note the App Service can successfully configure and read this, but when I run it locally I get various errors, depending on what I try:</p>
  <p>When calling AddAzureAppConfiguration I get the following exception:</p>
  <blockquote>
  <p>Process &quot;C:\Program Files\Microsoft Visual
  Studio\2022\Professional\Common7\IDE\Extensions\lybeojxv.4oe\TokenService\Microsoft.Asal.TokenService.exe&quot;
  has failed with unexpected error: TS003: Error, TS004: Unable to get
  access token.  'AADSTS50020: User account '{EmailHidden}' from
  identity provider 'live.com' does not exist in tenant 'Microsoft
  Services' and cannot access the application '{GuidHidden}'(Visual
  Studio) in that tenant. The account needs to be added as an external
  user in the tenant first. Sign out and sign in again with a different
  Azure Active Directory user account.</p>
  </blockquote>
  <p>My account in Azure AD was added as an external user to the tenant, my_email_com#EXT#@mycompany.onmicrosoft.com, although the Azure AD model of guests and members is <em>extremely</em> confusing.</p>
  <p>I tried signing out and in again, to no avail. I don't know why it says my user needs to be added as an external user to the tenant, when it already seems to be. <strong>Anyone have any suggestions</strong>?</p>
  <p>The entirety of my code is as follows:</p>
  <pre><code>using Azure.Identity;
  using Azure.Security.KeyVault.Secrets;
  
  var builder = WebApplication.CreateBuilder();
  
  // Azure KeyVault - succeeds locally and for Azure AppService
  var keyVaultUri = &quot;https://{MYVAULT}.vault.azure.net/&quot;;
  var client = new SecretClient(new Uri(keyVaultUri), new DefaultAzureCredential());
  var testSecret = client.GetSecret(&quot;secretTest&quot;).Value.Value;
  
  // Azure AppConfig
  var appConfigUri = &quot;https://{MYCONFIG}.azconfig.io/&quot;;
  // The following code fails when run locally:
  builder.Configuration.AddAzureAppConfiguration(options =&gt;
      options.Connect(new Uri(appConfigUri), new DefaultAzureCredential()));
  
  var app = builder.Build();
  var testConfig = app.Configuration[&quot;testConfig&quot;];
  
  app.MapGet(&quot;/&quot;, () =&gt; $&quot;secret: {testSecret}, appConfig: {testConfig}&quot;);
  app.Run();
  </code></pre>