Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. - MSI ( managed identity ) - azure

Question

I have followed this tutorial to secure Azure SQL Database connection from App Service using a managed identity.
Everything is working as expected in Azure, but when I am trying to debug the code locally I am getting below error message while opening the connection.
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
I found few references where they have mentioned we can use 'Azure Service Authentication' extension to debug locally.
I have logged into my Azure account in 'Azure Service Authentication' extension. But, still I am getting the error.
public IActionResult GetData()
{
var result = "connection opened.";
var test = config.GetSection("ConnectionStrings")["MyDbConnection"];
SqlConnection sql = new SqlConnection();
sql.ConnectionString = test;
sql.AccessToken = (new AzureServiceTokenProvider()).GetAccessTokenAsync("https://database.windows.net/").Result; //No issues while fetching the token.
try
{
//Getting exception here when running locally...
//Same code is working in Azure Webapp.
sql.Open();
}
catch (Exception ex)
{
result = $"Error : {ex.Message}";
}
finally
{
if ( sql != null && sql.State == System.Data.ConnectionState.Open )
{
sql.Close();
}
}
return Ok(result);
}
Other Details:
Visual Studio 2019 Community - Version 16.1.0 Preview 3.0
.NET Core 2.2
UPDATE 1:
This post talk about connectionString parameter for AzureServiceTokenProvider class. I tried providing RunAs=Developer; DeveloperTool=VisualStudio value for connectionString but still facing same issue.

Answer 1

Got below answer on Microsoft forum
Hello Hemant
I can see from the screenshot that you are logged in to Visual Studio with your Live ID.
Is the database created in a tenant associated with a work account?
Which user is set as AAD Admin on the Azure SQL Server?
The user account with which you are logged in to VS should be added as a user on the database for the authentication to work.
Alternatively, in the same article the you referenced, there is a section that talks about creating an AAD group and granting appropriate permissions.
You can add your user to the AAD group as well.
Please let us know if you have further questions.
Proposed as answer by Kalyan Chanumolu-MSFTMicrosoft employee, Moderator Wednesday, May 22, 2019 3:55 AM
Marked as answer by Hemant.Shelar Wednesday, May 22, 2019 4:22 AM
Wednesday, May 22, 2019 3:55 AM
Note: I was able to get it done by creating AAD group and granting appropriate permissions.
UPDATE 1:
I have followed below steps to get it work. Let me know if there exists any other possible solution
Created a AAD group e.g. 'hemantdotnetcore1'
Add users to this group ( generally these users will be developers
in DEV environment who want to access the database during
development )
Navigate to the SQL server instance and set 'Active Directory
admin'. In this example I have added 'hemantdotnetcore1' as a
active directory admin.
In visual studio navigate to 'Azure Service Authentication' and
log in with any one user who is part of group 'hemantdotnetcore1'
which is my Azure Active Directory Admin'
Now I can use below toke to open connection with the SQL Server.
sql.AccessToken = (new AzureServiceTokenProvider()).GetAccessTokenAsync("https://database.windows.net/").Result;