InvalidAudience error during websocket requests to Azure resources

Question

This might just be a transient issue, today we started receiving "401 Unauthorized" responses from the Azure Portal and the Azure CLI when trying to interact with our container apps. Specifically when trying to view log streams or connect to the console. When trying to access either the log streams or the console, the portal just hangs with a "connecting..." message.

I also see this when using the Azure CLI to run "az containerapp exec".

I was able to capture the following error using the browser dev tools:

Bearer error="invalid_token", error_description="S2S17001: SAL was able to validate the protocol, but validation failed as none of the inbound policies were satisfied. Validation failures: 'ff693ec1-2729-4777-af6c-4531c0439918: InvalidAudience'."

I've verified that my Azure CLI is the latest version and have logged out and then logged in again to refresh the access tokens.

On the Azure Portal side, I've tested from multiple browsers, multiple computers, and different user accounts (including our subscription owner account with service admin permissions).

I also created a new separate test resource group and container app just in case there was some issue with our existing app.

All of these tests resulted in the same error.

Are there any other suggestions for things I can do on my end to resolve the issue or do I just need to wait for the issue to be resolved in the Azure backend?

Thank you.

Answer 1

This appears to have been a transient issue as it is no longer occurring today.

The earlier post was after experiencing the issue for over 6 hours while the Azure status page didn't indicate any known issues.

Answer 2

Hi Shawn Smiley, I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this!

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Solution:

This looks like an impermanent issue as it is not occurring anymore.

• InvalidAudience errors indicate the access token is not valid for the resource you are trying to interact with. Try revoking the current token cache manually or force a refresh.
• Ensure that the portal's token handling isn't getting cached incorrectly. Clear the browser cache or try an Incognito/Private mode session which might help to force the portal to fetch a fresh authentication token.
• Ensure that the network connectivity is not being blocked by any firewall or network issues.

Please remember to "Accept Answer" if the sol has helped, so that others in the community facing similar issues can easily find the solution.