Azure KeyVault 401 Unauthorized in Docker Container - .NET 8 Fix

The Error

Inside Docker container:

Azure.RequestFailedException: 401 Unauthorized

Docker / Linux Fix - 2 Min

Containers cannot run az login interactively. Use one of these:

1. Production: Managed Identity - Assign a User-Assigned MI to your Container App/ACI/VM. DefaultAzureCredential picks it up automatically.

2. Local Dev: Service Principal - Set env vars in docker-compose or Dockerfile:
ENV AZURE_TENANT_ID=xxx
ENV AZURE_CLIENT_ID=xxx
ENV AZURE_CLIENT_SECRET=xxx

3. Code stays same: builder.Configuration.AddAzureKeyVault(new Uri(vaultUri), new DefaultAzureCredential())

Root Cause

DefaultAzureCredential tries: EnvVars → ManagedIdentity → VS → az cli. In Docker, only EnvVars or ManagedIdentity work. No browser for az login.

Also see: Fix 401 in Visual Studio | Original 401 Fix