Accessing Azure resources from internal tool in Azure DevOps

I need to create/configure several Azure resources following some intricate business logic, so we wrote a C# application for it.

It runs fine locally, but when running through the DevOps pipeline it fails because it cannot successfuly authenticate against Azure.

For example, I need to create a new Key in a KeyVault.

I have a Service Connection with

• Connection Type: Azure Resource Manager
• Identity Type: App registration
• Credential: Workload identity federation

The App Registration has "Key Vault Secrets User" and "Key Vault Crypto Officer" role assignments on the Key Vault.

I can use this Service Connection fine with a AzureKeyVault@2 task to get the KeyVault Secrets, but I can't figure out how to propagate the Azure Credentials to the C# application. I have tried with AzurePowerShell@5 task and AzureCLI@2 task with the inline script

.\Application.exe

Both tasks display the correct account details, but when the application tries to authenticate against Azure I always get:

Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.microsoftonline.com/ca096d70-4356-4f4a-9338-5676a5aa600e. Exception Message: Tried the following 3 methods to get an access token, but none of them worked. Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.microsoftonline.com/ca096d70-4356-4f4a-9338-5676a5aa600e. Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. MSI ResponseCode: BadRequest, Response: {"error":"invalid_request","error_description":"Identity not found"} Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.microsoftonline.com/ca096d70-4356-4f4a-9338-5676a5aa600e. Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Visual Studio Token provider file not found at "C:\Users\VssAdministrator\AppData\Local.IdentityService\AzureServiceAuth\tokenprovider.json" Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.microsoftonline.com/ca096d70-4356-4f4a-9338-5676a5aa600e. Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command, operable program or batch file. at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAccessTokenAsyncImpl(String authority, String resource, String scope)

Am I missing some key detail or is this simply a scenario that is not supported in DevOps?