Azure虚拟机夜间数据库更新流程中ManagedIdentityCredential认证随机失败问题排查求助

云上老周

2026-4-28

我之前在几个企业客户的自动化运维场景里碰到过和你一模一样的问题——Azure VM托管身份连接SQL MI时间歇性认证失败，同一进程里前一个库正常，下一个就随机报错。先给你分享几个排查深层原因的方向，再聊聊你关于核心库重试的疑问：

一、排查深层原因的关键方向

检查VM的IMDS端点可用性
错误提示No Managed Identity endpoint found本质是VM无法访问Instance Metadata Service（IMDS）的本地端点http://169.254.169.254。你可以在故障发生时，直接在VM上运行以下命令手动测试：
```
Invoke-RestMethod -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://database.windows.net/' -Headers @{Metadata='true'}
```
如果这个请求也失败，说明是IMDS临时故障或者VM的网络/权限限制了访问；如果成功，那问题可能出在SQL客户端库和身份库的交互上。
检查VM资源负载和并发情况
夜间自动化批量更新25个库，很可能和其他后台任务争抢VM的CPU、内存或网络资源。当VM负载过高时，IMDS的请求可能被阻塞或超时。建议查看故障发生时VM的Azure监控指标（CPU使用率、内存压力、网络吞吐量），确认是否有资源瓶颈。
核对SQL MI的托管身份权限同步
虽然你已经配置了VM托管身份为SQL MI的sysAdmin，但要注意：托管身份的权限是通过服务主体同步到SQL MI的，偶尔会存在同步延迟。可以手动检查每个数据库中是否存在对应的MI登录和用户，执行以下SQL语句验证：
```
SELECT name, type_desc FROM sys.server_principals WHERE name = 'your-vm-managed-identity-name';
SELECT name, type_desc FROM sys.database_principals WHERE name = 'your-vm-managed-identity-name';
```
升级客户端库版本
旧版本的Microsoft.Data.SqlClient或Azure.Identity可能存在并发请求下的托管身份认证bug。比如早期版本在短时间内多次请求token时，会出现IMDS端点获取失败的问题。建议升级到这两个库的最新稳定版，很多这类间歇性问题已经被修复。

二、除重试外的临时解决方案

预获取token并复用
不要让每个数据库连接都单独请求token，而是在脚本开头一次性获取托管身份的token，然后在所有数据库连接中复用这个token。示例代码如下：

# 预获取token
$credential = New-Object Azure.Identity.ManagedIdentityCredential
$tokenRequest = $credential.GetTokenAsync("https://database.windows.net/")
$token = $tokenRequest.Result.Token

# 连接数据库时复用token
$connectionString = "Server=tcp:xxxxx-tcc-sql.2222.database.windows.net,1433;Database=yyyyy;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
$conn = New-Object Microsoft.Data.SqlClient.SqlConnection($connectionString)
$conn.AccessToken = $token
$conn.Open()

这样可以大幅减少对IMDS的调用次数，降低故障概率。

手动调整IMDS请求的重试逻辑
如果必须每次连接都请求token，可以在PowerShell中对IMDS请求添加自定义重试，比如针对超时或端点不可用的情况，循环重试3-5次，每次间隔2秒：

function Get-ManagedIdentityToken {
    $retryCount = 0
    $maxRetries = 3
    while ($retryCount -lt $maxRetries) {
        try {
            return Invoke-RestMethod -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://database.windows.net/' -Headers @{Metadata='true'} -TimeoutSec 10
        }
        catch {
            $retryCount++
            Write-Warning "Token request failed, retrying ($retryCount/$maxRetries)..."
            Start-Sleep -Seconds 2
        }
    }
    throw "Failed to get token after $maxRetries retries"
}

三、关于核心库为何不内置重试的疑问

这个其实是设计权衡的结果，主要有几个原因：

故障类型无法统一判断：核心库没法区分“临时故障”（比如IMDS临时不可用）和“永久故障”（比如托管身份被禁用、权限不足）。如果对所有认证失败都重试，反而会加重无效请求的负载。
业务重试策略差异大：不同业务对重试的容忍度完全不同——你的夜间自动化可以接受5次重试、间隔10秒，但实时业务可能只允许1次重试、间隔1秒。核心库无法提供通用的重试参数。
部分错误不可重试：比如No Managed Identity endpoint found，在某些场景下是配置错误导致的（比如VM没有启用托管身份），重试也没用，所以核心库默认不会对这类错误重试。

不过，Azure.Identity其实已经内置了针对网络超时、服务限流等临时故障的重试逻辑，你可以通过配置RetryOptions来调整重试次数和间隔：

$options = New-Object Azure.Identity.ManagedIdentityCredentialOptions
$options.Retry.MaxRetries = 3
$options.Retry.Delay = [TimeSpan]::FromSeconds(2)
$credential = New-Object Azure.Identity.ManagedIdentityCredential($options)

附上你提供的错误日志供参考：

[06:58:18][Step 5/6] Initialize-FMReportUrls : 6:58:07 AM:Using env file from command line: 
[06:58:18][Step 5/6] .\Package\BuildScripts\Configs\mmmmmTestAzure.fmenv.xml 6:58:13 AM:Loaded environment: mmmmmTestAzure 
[06:58:18][Step 5/6] System.AggregateException: One or more errors occurred. ---> Azure.Identity.CredentialUnavailableException: 
[06:58:18][Step 5/6] ManagedIdentityCredential authentication unavailable. No Managed Identity endpoint found. at 
[06:58:18][Step 5/6] Azure.Identity.ManagedIdentityClient.<AuthenticateAsync>d__12.MoveNext() --- End of stack trace from previous location 
[06:58:18][Step 5/6] where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at 
[06:58:18][Step 5/6] System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at 
[06:58:18][Step 5/6] Azure.Identity.ManagedIdentityCredential.<GetTokenImplAsync>d__9.MoveNext() --- End of stack trace from previous 
[06:58:18][Step 5/6] location where exception was thrown --- at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex) 
[06:58:18][Step 5/6] at Azure.Identity.ManagedIdentityCredential.<GetTokenImplAsync>d__9.MoveNext() --- End of stack trace from previous 
[06:58:18][Step 5/6] location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task 
[06:58:18][Step 5/6] task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at 
[06:58:18][Step 5/6] Azure.Identity.ManagedIdentityCredential.<GetTokenAsync>d__7.MoveNext() --- End of stack trace from previous location 
[06:58:18][Step 5/6] where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at 
[06:58:18][Step 5/6] System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at 
[06:58:18][Step 5/6] System.Threading.Tasks.ValueTask`1.get_Result() at 
[06:58:18][Step 5/6] Microsoft.Data.SqlClient.ActiveDirectoryAuthenticationProvider.<AcquireTokenAsync>d__19.MoveNext() --- End of inner 
[06:58:18][Step 5/6] exception stack trace --- at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions) 
[06:58:18][Step 5/6] at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification) at 
[06:58:18][Step 5/6] System.Threading.Tasks.Task`1.get_Result() at 
[06:58:18][Step 5/6] Microsoft.Data.SqlClient.SqlInternalConnectionTds.GetFedAuthToken(SqlFedAuthInfo fedAuthInfo) at 
[06:58:18][Step 5/6] Microsoft.Data.SqlClient.SqlInternalConnectionTds.OnFedAuthInfo(SqlFedAuthInfo fedAuthInfo) at 
[06:58:18][Step 5/6] Microsoft.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, 
[06:58:18][Step 5/6] BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) at 
[06:58:18][Step 5/6] Microsoft.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, 
[06:58:18][Step 5/6] BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) at 
[06:58:18][Step 5/6] Microsoft.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK) at 
[06:58:18][Step 5/6] Microsoft.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, 
[06:58:18][Step 5/6] SecureString newSecurePassword, Boolean ignoreSniOpenTimeout, TimeoutTimer timeout, Boolean withFailover, Boolean 
[06:58:18][Step 5/6] isFirstTransparentAttempt, Boolean disableTnir) at 
[06:58:18][Step 5/6] Microsoft.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(ServerInfo serverInfo, String newPassword, 
[06:58:18][Step 5/6] SecureString newSecurePassword, Boolean redirectedUserInstance, SqlConnectionString connectionOptions, SqlCredential 
[06:58:18][Step 5/6] credential, TimeoutTimer timeout) at Microsoft.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(TimeoutTimer 
[06:58:18][Step 5/6] timeout, SqlConnectionString connectionOptions, SqlCredential credential, String newPassword, SecureString 
[06:58:18][Step 5/6] newSecurePassword, Boolean redirectedUserInstance) at

内容的提问来源于stack exchange，提问作者Tony Campney

Azure虚拟机夜间数据库更新流程中ManagedIdentityCredential认证随机失败问题排查求助

一、排查深层原因的关键方向 #

二、除重试外的临时解决方案 #

三、关于核心库为何不内置重试的疑问 #

一、排查深层原因的关键方向

二、除重试外的临时解决方案

三、关于核心库为何不内置重试的疑问