AzureUSGovernment; `az identity create`; NoRegisteredProviderFound API version `2021-09-30-preview` for type `userAssignedIdentities`

[aldass-snc]

Describe the bug

Error when using Az CLI v2.37.0 with API version 2021-09-30-preview for type userAssignedIdentities in AzureUSGovernment cloud. The error happens when doing an az identity create ... (see below).

Note: works correctly if using Az CLI v2.36.0

Command Name

az identity create --subscription {} --name {} --resource-group {}

Errors:

(NoRegisteredProviderFound) No registered resource provider found for location 'usgov*****' and API version '2021-09-30-preview' for type 'userAssignedIdentities'. The supported api-versions are '2015-08-31-PREVIEW, 2018-11-30'. The supported locations are 'usgovvirginia, usgoviowa, usgovtexas, usgovarizona, usdodeast, usdodcentral'.
Code: NoRegisteredProviderFound
Message: No registered resource provider found for location 'usgov*****' and API version '2021-09-30-preview' for type 'userAssignedIdentities'. The supported api-versions are '2015-08-31-PREVIEW, 2018-11-30'. The supported locations are 'usgovvirginia, usgoviowa, usgovtexas, usgovarizona, usdodeast, usdodcentral'.

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• az cloud set --name AzureUSGovernment
• az login
• az extension update --name aks-preview
• az identity create --subscription {} --name {} --resource-group {}

Expected Behavior

Should return a json payload of the created managed identity.

Environment Summary

Windows-10-10.0.19044-SP0
Python 3.10.4
Installer: MSI

azure-cli 2.37.0

Extensions:
account 0.2.3
aks-preview 0.5.75

Dependencies:
msal 1.18.0b1
azure-mgmt-resource 21.1.0b1

Additional Context

[zhoxing-ms]

Al D. (@aldass-snc) This issue is caused by upgrading the api-version for Microsoft.ManagedIdentity in the latest profile. PR link #22284
Since CLI currently does not support setting different api-version for different clouds, so under the same profile, all clouds use the same api-version for easier maintenance. CLI only supports setting different api-version for different profiles.

So we currently have two work arounds to bypass this problem:

1. If the environment allows, please temporarily downgrade the CLI version to 2.36.0
2. If the environment does not allow to downgrade the CLI version, before executing the az identity create command, you can execute az cloud set -n AzureUSGovernment --profile 2020-09-01-hybrid to switch the profile. After creating identitites, then you can execute az cloud set -n AzureUSGovernment --profile latest to switch the latest profile back.

[zhoxing-ms]

Arndt Schwenkschuster (@arndt-s) May I ask do you know when the api-version 2021-09-30-preview for Microsoft.ManagedIdentity will be supported in AzureUSGovernment?

[aldass-snc]

...your work arounds...

Understood... gonna have to go with 2.36.0 for now then since it does work with that version.

...when the api-version 2021-09-30-preview for Microsoft.ManagedIdentity will be supported in AzureUSGovernment...

Officially, AzureUSGovernment tracks +90 days after Azure Commercial features go GA... but about 80% of the time it does just seem to work in AzureUSGovernment... but, figuring out which %20 does not work is the hard part. 😄

[arndt-s]

Xing Zhou (@zhoxing-ms)

May I ask do you know when the api-version 2021-09-30-preview for Microsoft.ManagedIdentity will be supported in AzureUSGovernment?

We are in the progress of enabling sovereign clouds but don't have any ETA yet.

Al D. (@aldass-snc)
As far as I know the guidance for GA is to support all of them at once. However, this feature is in public preview and the guidance here for Fairfax is 30 days since public preview in public if I'm not mistaken.

[arndt-s]

Al D. (@aldass-snc) 2.37.0 is working now too.

[aldass-snc]

Arndt Schwenkschuster (@arndt-s) oh nice, I'll get a chance to test the new stack over the weekend and will let you know.