本地账户下无法使用Azure资源托管身份的问题求助

我在Azure订阅中创建了Azure SQL数据库，尝试采用托管身份方式进行认证。我的DbConnection字符串如下：

Server=tcp:server-name.database.windows.net,1433; Database=DB Dev; Authentication=Active Directory Default; TrustServerCertificate=True;

针对其他资源（Cognitive Search和Service Bus），我做了如下配置：

services.AddAzureClients(clientBuilder =>
{
    clientBuilder
        .AddServiceBusClientWithNamespace(serviceBusFullyQualifiedNamespace)
        .WithName(serviceBusClientName);

    clientBuilder.AddSearchClient(
            new Uri(searchServiceEndpoint),
            "idx-name",
            new AzureKeyCredential(queryApiKey))
        .WithName(searchServiceClientName);

    // Use DefaultAzureCredential by default
    clientBuilder.UseCredential(new DefaultAzureCredential());
});

我在Visual Studio中登录的是拥有这些资源的同一Azure账户，但启动应用时出现以下错误：

Azure.Identity[3]
      EnvironmentCredential.GetToken was unable to retrieve an access token. Scopes: [ https://database.windows.net//.default ] ParentRequestId:  Exception: Azure.Identity.CredentialUnavailableException (0x80131500): EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot

Azure.Core[18]
      Request [d62d1dff-e775-4a43-a276-17658251e040] exception System.Threading.Tasks.TaskCanceledException: The operation was cancelled because it exceeded the configured timeout of 0:00:01. Network timeout can be adjusted in ClientOptions.Retry.NetworkTimeout.
       ---> System.Threading.Tasks.TaskCanceledException: A task was canceled.
         at System.Net.Http.HttpClient.HandleFailure(Exception e, Boolean telemetryStarted, HttpResponseMessage response, CancellationTokenSource cts, CancellationToken cancellationToken, CancellationTokenSource pendingRequestsCts)
         at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
         at Azure.Core.Pipeline.HttpClientTransport.ProcessAsync(HttpMessage message, Boolean async)
         at Azure.Core.Pipeline.HttpPipelineTransportPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline)         at Azure.Core.Pipeline.RequestActivityPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
         at Azure.Core.Pipeline.ResponseBodyPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
         --- End of inner exception stack trace ---
         at Azure.Core.Pipeline.ResponseBodyPolicy.ThrowIfCancellationRequestedOrTimeout(CancellationToken originalToken, CancellationToken timeoutToken, Exception inner, TimeSpan timeout)
         at Azure.Core.Pipeline.ResponseBodyPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
         at Azure.Core.Pipeline.LoggingPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)

ManagedIdentityCredential.GetToken was unable to retrieve an access token. Scopes: [ https://database.windows.net//.default ] ParentRequestId:  Exception: Azure.Identity.CredentialUnavailableException (0x80131500): ManagedIdentityCredential authentication unavailable. Multiple attempts failed to obtain a token from the managed identity endpoint
         
Azure.Identity[10]
      False MSAL 4.49.1.0 MSAL.NetCore .NET 6.0.15 Microsoft Windows 10.0.19045 [2023-04-16 07:34:32Z - eb2dde69-b2de-48e6-b48c-2d01cd1adc66] Exception type: Azure.Identity.CredentialUnavailableException
      ---> Inner Exception Details
      Exception type: System.AggregateException
      ---> Inner Exception Details
      Exception type: System.Threading.Tasks.TaskCanceledException
      ---> Inner Exception Details
      Exception type: System.Threading.Tasks.TaskCanceledException

我作为订阅所有者，无法理解为何无法通过Visual Studio账户登录，是否需要进行额外配置？
针对Azure SQL数据库，我已为管理员组创建用户（且已将自己加入该组），并在防火墙配置中白名单了我的IP。

1. 确认DefaultAzureCredential的本地认证触发逻辑 #

DefaultAzureCredential会按顺序尝试环境变量、托管身份、Visual Studio/VS Code、Azure CLI等认证方式。本地开发时需注意：

• 检查Visual Studio「工具」→「选项」→「Azure服务验证」，确保当前登录账户是访问Azure资源的目标账户。
• 即使是订阅所有者，加入SQL管理员组后需等待10-15分钟，让Azure AD权限同步到SQL数据库。

2. 调整网络超时参数 #

错误日志显示连接超时仅1秒，可通过以下方式延长：

• 配置DefaultAzureCredential的重试与超时：

var credential = new DefaultAzureCredential(new DefaultAzureCredentialOptions
{
    Retry =
    {
        NetworkTimeout = TimeSpan.FromSeconds(10),
        MaxRetries = 3
    }
});
services.AddAzureClients(clientBuilder =>
{
    // 保留原有客户端配置
    clientBuilder.UseCredential(credential);
});

• 修改SQL连接字符串，添加连接超时参数：

Server=tcp:server-name.database.windows.net,1433; Database=DB Dev; Authentication=Active Directory Default; TrustServerCertificate=True; Connect Timeout=30;

3. 验证SQL数据库的AD身份配置 #

• 确认Azure SQL服务器的Azure AD管理员已设置为你所在的管理员组（不是仅在数据库中创建用户）。
• 在SQL数据库中执行以下语句，验证你的账户映射是否正确：

SELECT name, type_desc FROM sys.database_principals WHERE name = '你的Azure AD用户名或组名';

若无结果，需重新创建数据库用户并分配权限。

4. 本地开发强制指定Visual Studio认证 #

如果自动认证逻辑异常，可在调试环境直接使用VisualStudioCredential：

#if DEBUG
var credential = new VisualStudioCredential();
#else
var credential = new DefaultAzureCredential();
#endif
services.AddAzureClients(clientBuilder =>
{
    // 保留原有客户端配置
    clientBuilder.UseCredential(credential);
});

内容的提问来源于stack exchange，提问作者Sergiu Molnar