本地连接Azure Keyvault遇ForbiddenByRbac错误，求排查解决方法

我本地使用以下C#代码连接Azure KeyVault时失败：

string tid = builder.Configuration["AzureADTenantId"];
        
DefaultAzureCredentialOptions o = new DefaultAzureCredentialOptions()
{
    VisualStudioTenantId = tid,
    SharedTokenCacheTenantId = tid 
};
            
builder.Configuration.AddAzureKeyVault(new Uri($"https://mykeyvault.vault.azure.net/"), new DefaultAzureCredential(o));

执行后返回如下错误：

{"error":{"code":"Forbidden","message":"Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.\r\nCaller: appid=<APP_ID>;oid=<OID>;iss=https://sts.windows.net/<DIRECTORY_ID>/\r\nAction: 'Microsoft.KeyVault/vaults/secrets/readMetadata/action'\r\nResource: '/subscriptions/<SUB_ID>/resourcegroups/my-rg-process-service/providers/microsoft.keyvault/vaults/mykv'\r\nAssignment: (not found)\r\nDenyAssignmentId: null\r\nDecisionReason: null \r\nVault: mykv;location=westeurope\r\n","innererror":{"code":"ForbiddenByRbac"}}}

已完成的排查操作 #

• 上周功能正常，怀疑问题出在本地系统
• 单独使用VisualStudioCredential仍报相同错误
• 确认KeyVault的RBAC权限配置，当前账户已被分配密钥读取相关权限
• 核对KeyVault网络配置，允许本地IP地址访问
• PowerShell中执行以下命令可正常读取密钥：

az login
az keyvault list
Get-AzKeyVaultSecret -VaultName "mykv" -Name "mysecret"

• Visual Studio中已设置正确的Azure认证账户，但该账户属于多个租户，KeyVault位于默认租户中

建议解决方向 #

1. 清理本地Azure认证缓存

   • 删除%USERPROFILE%\.azure目录下的所有缓存文件，之后重新登录Visual Studio或Azure CLI
   • 在Visual Studio中进入「工具>选项>Azure服务认证」，点击「账户管理」，移除当前账户后重新添加

2. 强制绑定目标租户ID

   • 在DefaultAzureCredentialOptions中添加InteractiveBrowserTenantId = tid，确保所有认证方式都指向KeyVault所在租户：

     DefaultAzureCredentialOptions o = new DefaultAzureCredentialOptions()
     {
         VisualStudioTenantId = tid,
         SharedTokenCacheTenantId = tid,
         InteractiveBrowserTenantId = tid
     };
     

   • 或者直接使用InteractiveBrowserCredential指定租户ID测试，排除多租户干扰：

     var credential = new InteractiveBrowserCredential(new InteractiveBrowserCredentialOptions { TenantId = tid });
     builder.Configuration.AddAzureKeyVault(new Uri("https://mykeyvault.vault.azure.net/"), credential);
     

3. 确认Visual Studio的租户上下文

   • 在Visual Studio的「云资源管理器」中，切换到KeyVault所在的租户
   • 重启Visual Studio，刷新认证会话

4. 验证本地CLI的租户与订阅匹配

   • 执行az account show确认当前CLI登录的租户ID与KeyVault所在租户一致
   • 若存在多租户，执行az account set --subscription <SUB_ID>切换到目标订阅对应的租户

内容的提问来源于stack exchange，提问作者usselite