Adding a custom domain to API Mangement Service fails

Question

Adding a custom domain to API Mangement Service fails

Eric Mueller (dapi1) 0

Hello everyone,

when trying to add a custom domain to our API Management Service, using a custom certificate (imported in a KeyVault), the custom domain disappears after a few seconds.

When checking the activity logs of the service, after some time the following error appears:

Unable to Update API service at this time. Please check resource group deployment logs for specific errors, correct them and try again

We also get the following information:

correlationId 6dade8a0-3a75-4135-a093-aedef917a35e and TimeStamp 1/7/2026 2:56:23 PM

Is there any way to get more information out of this error ?

My certificates settings in the service look like the following:

User's image

It is worth mentioning, that the certificate is valid until the end of this year and that the CNAME pointing to <service-name>.azure-api.net is configured and valid.

Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-01-23T08:06:58.2133333+00:00

Hi @Eric Mueller (dapi1)

As discussed in teams, After removing the Locks the custom domain operation with powershell was successful in the Activity Logs but the custom domain was not visible. Did you try the same operation with Portal? and what's the latest status on the issue? Is it resolved?
Sonny Gillissen 4,077 Reputation points MVP

2026-01-23T13:09:39.8+00:00
Hi Eric Mueller (dapi1)

Thanks for reaching out on Microsoft Q&A!

When a custom domain + certificate is applied to APIM, Azure performs an asynchronous validation and rollout. If any validation step fails after save, APIM silently rolls back, removing the hostname from the config.

This is where you should be able to find the actual error:

Go to the Resource Group of your APIM

Select Deployments

Sort by Time

Open the failed deployment with timestamp close to 1/7/2026 2:56:23 PM

Expand:

Operation details

Status message

Error and then Details

You will usually see something specific like:

CertificateNotFound

KeyVaultAccessDenied

Hostname already in use

Invalid certificate chain

Secrets Get permission missing

Depending on the specific error you can contact Microsoft Support using the Correlation ID provided in the error. In case of no permissions you can provide the API Management principal with Certificates 'Get/List' permissions and also for Secrets.

Another thing to check is wheter your certificate chain is valid.

Please click ‘Accept answer’ if you think my answer is helpful. Feel free to drop additional queries in the comments below!

Kind regards,

Sonny

1 answer

Your answer

Siddhesh Desai 8,210 Reputation points Microsoft External Staff Moderator

2026-01-23T08:06:58.2133333+00:00

Hi @Eric Mueller (dapi1)

As discussed in teams, After removing the Locks the custom domain operation with powershell was successful in the Activity Logs but the custom domain was not visible. Did you try the same operation with Portal? and what's the latest status on the issue? Is it resolved?
Sonny Gillissen 4,077 Reputation points MVP

2026-01-23T13:09:39.8+00:00

Hi Eric Mueller (dapi1)

Thanks for reaching out on Microsoft Q&A!

When a custom domain + certificate is applied to APIM, Azure performs an asynchronous validation and rollout. If any validation step fails after save, APIM silently rolls back, removing the hostname from the config.

This is where you should be able to find the actual error:

Go to the Resource Group of your APIM

Select Deployments

Sort by Time

Open the failed deployment with timestamp close to 1/7/2026 2:56:23 PM

Expand:

Operation details

Status message

Error and then Details

You will usually see something specific like:

CertificateNotFound

KeyVaultAccessDenied

Hostname already in use

Invalid certificate chain

Secrets Get permission missing

Depending on the specific error you can contact Microsoft Support using the Correlation ID provided in the error. In case of no permissions you can provide the API Management principal with Certificates 'Get/List' permissions and also for Secrets.

Another thing to check is wheter your certificate chain is valid.

Please click ‘Accept answer’ if you think my answer is helpful. Feel free to drop additional queries in the comments below!

Kind regards,

Sonny

Answer 1

Hi @Eric Mueller (dapi1)

Thank you for reaching out to Microsoft Q&A

As per our discussion on teams the engineering team has provided below resolution to fix your issue:

Customer TXT record has the wrong value; you need to modify it or delete it but make sure CNAME record is valid.

The error is from App Service when they do the custom domain validation before adding, not from APIM. The link customer shared is for APIM free certificate feature and the Txt is required for apimuid.<custom domain>. But the error message complained about asuid.<custom domain>. Customer must try to configure the same domain for other App Service service before. So please follow my instructions before to correct Txt record. [Customer TXT record has the wrong value; they need to modify it or delete it but make sure CNAME record is valid.]