Azure Maps拒绝部分应用请求返回401，咨询是否有近期变更

现象描述 #

数小时前，Azure Maps 突然拒绝了我的 Azure DevOps 流水线及生产环境 Azure App Service 的请求，但开发/测试环境的 App Service 请求仍能正常被接受。

错误日志示例 #

2025-07-28T22:53:11.5892482Z   Error Message:
2025-07-28T22:53:11.5892964Z    Azure.RequestFailedException : The provided Azure AD application ID is forbidden from the allowed application IDs.
2025-07-28T22:53:11.5893422Z Status: 401 (Unauthorized)
2025-07-28T22:53:11.5893608Z ErrorCode: invalid_token
2025-07-28T22:53:11.5893775Z Content:
2025-07-28T22:53:11.5893925Z {
2025-07-28T22:53:11.5894073Z   "error": {
2025-07-28T22:53:11.5894270Z     "code": "invalid_token",
2025-07-28T22:53:11.5894556Z     "message": "The provided Azure AD application ID is forbidden from the allowed application IDs.",
2025-07-28T22:53:11.5894788Z     "target": "WWW-Authenticate",
2025-07-28T22:53:11.5894963Z     "details": []
2025-07-28T22:53:11.5895112Z   }
2025-07-28T22:53:11.5895250Z }
2025-07-28T22:53:11.5895395Z Headers:
2025-07-28T22:53:11.5895566Z Transfer-Encoding: chunked
2025-07-28T22:53:11.5895995Z WWW-Authenticate: SharedKey realm="https://atlas.microsoft.com/", error="invalid_token", error_description="The provided Azure AD application ID is forbidden from the allowed application IDs."
2025-07-28T22:53:11.5896324Z x-ms-azuremaps-region: REDACTED
2025-07-28T22:53:11.5896520Z X-Content-Type-Options: REDACTED
2025-07-28T22:53:11.5896718Z Strict-Transport-Security: REDACTED
2025-07-28T22:53:11.5896905Z X-Cache: REDACTED
2025-07-28T22:53:11.5897078Z X-MSEdge-Ref: REDACTED
2025-07-28T22:53:11.5897273Z Date: Mon, 28 Jul 2025 22:53:11 GMT
2025-07-28T22:53:11.5897471Z Content-Type: application/json
2025-07-28T22:53:11.5897644Z   Stack Trace:
2025-07-28T22:53:11.5898033Z      at Azure.Maps.TimeZones.TimezoneRestClient.GetTimezoneByCoordinatesAsync(JsonFormat format, IEnumerable`1 coordinates, String acceptLanguage, Nullable`1 options, Nullable`1 timeStamp, Nullable`1 daylightSavingsTimeFrom, Nullable`1 daylightSavingsTimeLastingYears, CancellationToken cancellationToken)
2025-07-28T22:53:11.5898606Z    at Azure.Maps.TimeZones.MapsTimeZoneClient.GetTimeZoneByCoordinatesAsync(GeoPosition coordinates, GetTimeZoneOptions options, CancellationToken cancellationToken)

认证方式及代码实现 #

流水线及 App Service 均采用共享密钥认证，代码实现如下：

var mapsKey = await secretProvider.GetSecretAsync(mapsKeyId);
var credential = new AzureKeyCredential(mapsKey);
var searchClient = new MapsSearchClient(credential);
var result = await searchClient.GetReverseGeocodingAsync(coordinates);

代码在本地运行正常，推测是由于我的 MS ID 拥有 Maps 的 Contributor 权限。

权限配置详情 #

• 流水线的系统托管标识继承了 Maps 的 Contributor 角色
• API 标识未拥有 Maps 的任何角色
• 生产实例拥有 Azure Maps Data Reader 角色
• 生产与开发/测试环境位于不同订阅，使用独立的 Azure Maps 实例，ADO 流水线使用开发/测试订阅

更新信息 #

更新于2025-07-29 13:54 UTC：该问题已在夜间自行解决，但 Azure 门户及状态页面未显示昨日数小时内存在异常。

疑问 #

Azure Maps 近期是否有相关变更？

内容的提问来源于stack exchange，提问作者David Braverman