A managed identity must be reachable and correctly scoped before it can be used.

If the VM can’t obtain tokens, the issue is often networking, disabled identity endpoints, or role assignments applied at the wrong scope. Even when everything is correct, permission changes can take a few minutes to propagate.

People often assume identity assignment is instant and global, which leads to confusion during testing.

Takeaway: Managed identities depend on both token access and correct scope.