Azure Arc Windows Admin Center Extension: RetrieveCertificate: Failed to retrieve certificate from key vault using app service

Jshot 15 Reputation points

I'm seeing the following extension error when attempting to install the Windows Admin Center extension. The install process occurs but then the extension goes into a "Failed" state with the following message - anyone else run into this problem?

RetrieveCertificate: Failed to retrieve certificate from key vault using app service

  1. Leonardo Mariano Côco 155 Reputation points

    Hi — yes, I’ve seen that one. It usually means the WAC extension’s app service identity can’t read the certificate from the Key Vault (permissions/network), so the install completes and then flips to Failed when it tries to fetch the cert.

    Quick things to check:

    Key Vault access: make sure the identity used by the extension/app service has Get permission for Certificates and Secrets (KV certs are backed by a secret).

    Networking: if the Key Vault has public access disabled, firewall restrictions, or private endpoint only, the app service won’t be able to reach it unless you’ve set that up accordingly.

    Correct vault/cert: confirm the cert exists, isn’t disabled/expired, and you’re pointing to the right Key Vault and certificate name/version.

    If you can share whether your Key Vault is using RBAC or access policies, and whether public network access is disabled, it’s usually possible to pinpoint the exact fix in one step.

  2. Jshot 15 Reputation points

    Isn’t it all managed by the azure arc service? I don’t recall seeing anything about Key Vaults within the arc documentation.

  3. Suchitra Suregaunkar 14,595 Reputation points • Microsoft External Staff • Moderator

    Hello Jshot

    The error “RetrieveCertificate: Failed to retrieve certificate from key vault using app service” typically indicates that the Windows Admin Center (WAC) extension's managed identity isn't able to fetch the certificate from Key Vault. This occurs after installation, when it attempts to access the certificate and fails, flipping the extension state to "Failed".

    As a resolution Confirm Key Vault Permissions:

    Ensure the principal identity that the extension is using, typically the system- or user-assigned managed identity of the WAC App Service, has these Key Vault access rights:

    Get permissions on Certificates and Secrets (since certificate objects are backed by secrets).

    To check and assign:

    1. In the Key Vault, navigate to Access policies (if using Vault policies) or Role assignments (if using Azure RBAC).
    2. Add or assign:
      • Certificates → Get
      • Secrets → Get
    3. Target the specific identity (e.g., Microsoft.Web/sites/WAC…).

    Verify Network Access: If your Key Vault has a restricted network policy:

    • Confirm public network access is enabled, or
    • If using a private endpoint, ensure the App Service can reach it via VNet integration or Private Endpoint configuration.

    Double-check:

    • Firewall and VNet/subnet access
    • Integration of App Service with the required VNet

    Validate Certificate Availability: Make sure The certificate exists and is not disabled, expired, or deleted and The URL, certificate name, and version (if specified) match exactly

    1. Identify Identity Configuration:

    Note whether:

    You’re using Access policies or Azure RBAC

    The managed identity is system-assigned or user-assigned

    Often issues arise when mixing RBAC and certificate identity methods even slight misconfigurations here disrupt retrieval.

    If you have any other queries, please do let us know.

    Thanks,
    Suchitra.

  4. Jshot 15 Reputation points

    I don't believe this is needed for the Azure Arc WAC extension - it's a managed service/extension. What else could be the problem, preventing the extension from working?

  5. Leonardo Mariano Côco 155 Reputation points

    You’re right that you don’t “host” the app service yourself, but the extension still has to pull a cert from your Key Vault somehow — so it ends up being the same two buckets: identity/permissions or network.

    What I’d check next:

    How the Key Vault is locked down: if Public network access is disabled / firewall is restricted / private endpoint only, the managed extension often can’t reach it and you’ll get exactly this error.

    Which access model the vault is using: if the vault is set to RBAC, but the expected permissions were configured under Access Policies (or vice-versa), retrieval will fail even though it “looks configured”.

    Scope of permissions: the identity needs Secrets Get as well as Certificates Get (KV certs are backed by a secret). If only Certificates are granted, it still fails.

    Wrong identity: verify which managed identity/service principal the extension is actually using (system vs user-assigned) and grant access to that exact object.

    If you can share two things — (1) whether Key Vault public access is disabled / private endpoint only, and (2) whether the vault is using RBAC or access policies — we can usually pinpoint the cause quickly.

Sign in to comment

1 answer

  1. Peter Mavrakis 20 Reputation points

    We are having the same issue. Our windows admin center access suddenly died on our azure local instances, and we've been trying to reinstall the extension, but getting the same error.

    1. Jshot 15 Reputation points

      Did you ever figure it out?

    Sign in to comment
Sign in to answer

Your answer