VSC Azure App Service extension to Publish fails now

Question

VSC Azure App Service extension to Publish fails now

Stephen Hollister 5

Publishing via Azure portal to my website fails now when it did not before (6+ months ago).

User's image

Removed PII Information.

Everything looks ok in localhost. It builds the zip file, but the upload fails or gets canceled. This worked before, but I think it's a key/clientId/authorization problem. Did something expire? My msalConfig has a clientId that I cannot find on my Azure portal, but I didn't change anything.

Thanks for any help you can give me.

VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-17T13:03:41.11+00:00
Hello Stephen Hollister,

I understand why it looks like a key / clientId / authorization issue, but based on what you’ve shared, nothing in your application’s msalConfig has expired or changed.

Here’s what’s actually happening:

Your app builds successfully and the ZIP file is created, which confirms your code and local configuration are fine.

The failure happens during the upload step, before deployment completes.

The clientId you’re noticing (the GUID shown during sign‑in) is not your app registration. It belongs to the VS Code / Azure tooling authentication app, which is why you won’t find it in your Azure portal — and that is expected behavior.

The deployment is being cancelled because the account currently signed into VS Code does not exist (as a member or guest) in the target tenant. When Microsoft Entra ID can’t issue an access token for that tenant, the request is aborted, which is why you see the “operation was aborted” message.

This also explains why it worked before:

You were likely signed in with a different account at that time, or

Your account previously had access to the tenant and later lost it, or

VS Code is now automatically using a cached account that doesn’t have tenant access.

What to check :

Please ensure that:

The account which has access to your Azure resources appears in the VS Code Accounts menu

Under Azure → Accounts & Tenants, the correct tenant is selected

If you’re using a personal Microsoft account, it must be added as a guest user to the tenant, or you should sign in using the correct work/school account

No changes are required to your application code or MSAL configuration. Once VS Code is authenticated with an account that actually belongs to the tenant, the ZIP upload and deployment should succeed again.
Stephen Hollister 5 Reputation points

2026-04-17T13:50:36.63+00:00

My process worked 6 or so months ago and I did not change anything. Interestingly, my Azure portal shows NO app registrations?!? Do they expire? It seems like I need to register a new application (#3) and put in a new clientId, but I'm concerned that I will screw it up more. Can I pay someone to do it for me and perhaps clean up my account and offer advice?
Stephen Hollister 5 Reputation points

2026-04-17T14:20:10.74+00:00

Thanks, but I don't see "Accounts & Tenants." I see these choices:

I use a corporate account for TriSplit. I find the terminology confusing: tenant, subscription, client, app registration and more. In addition, I still have old "learning" stuff left over that I'm afraid to delete or clean up.
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-17T14:58:17.0466667+00:00
Stephen Hollister App registrations do not expire, and you don’t need to create a new one for publishing to Azure App Service from VS Code. The clientId you’re seeing is not your application’s app registration — it belongs to Microsoft’s built‑in VS Code / Azure tooling, which is why it doesn’t appear in your Azure portal. This is expected behavior.

The publish failure is occurring because VS Code is currently signed in with an account that doesn’t have access to the tenant/subscription where the App Service exists. When Microsoft Entra ID can’t issue an access token for that tenant, the ZIP upload is aborted, even though the build succeeds.

Recommended steps:

In VS Code, sign out of all accounts.

Restart VS Code.

Sign in again using your TriSplit work/school account.

Open the Azure extension and confirm the correct subscription is selected and the App Service appears.

Try publishing again.

No changes are required to your MSAL configuration or application code, and you don’t need to create a new app registration. Old learning resources or tenants can be safely ignored unless they’re actively selected.

If the App Service still doesn’t appear after re‑signing in, it means the signed‑in account doesn’t have access to that tenant, which would need to be addressed.

Please let me know if this helps or if you still see issues after trying the above.

Note: Just to confirm, are you signed into VS Code with the correct TriSplit work/school account and targeting the same tenant/subscription where the App Service exists? Also, please verify your account has the required role (Contributor / Website Contributor / Owner) on the App Service or its resource group. If the account, tenant, or role doesn’t match, the ZIP build succeeds but the publish gets cancelled.
Stephen Hollister 5 Reputation points

2026-04-17T17:07:35.9433333+00:00

I found Accounts & Tenants at the bottom and I have two tenants. I changed to the other (correct?) one, but the Publishing doesn't work. I select the subscription and it does nothing and I get no prompt to verify the publishing. Any advice?
Stephen Hollister 5 Reputation points

2026-04-17T17:17:25.1266667+00:00

I will give your latest advice a try.
Stephen Hollister 5 Reputation points

2026-04-17T19:40:49.07+00:00

I signed out and in of VSC and my Azure portal and then signed back in. Nether of the two "Accounts & Tenants" numbers in the VSC Azure Portal Extension match my Azure Portal account "Subscription ID." What are the Accounts & Tenants numbers? Is it not the subscription number? This used to work in the past and I made no changes. I tried publishing again and get the same failed result.
Stephen Hollister 5 Reputation points

2026-04-20T10:59:31.4433333+00:00

3. Sign in again using your TriSplit work/school account.

4. Open the Azure extension and confirm the correct subscription is selected and the App Service appears.

VSC account matches the Azure Extension account. ******@trisplitinc.onmicrosoft.com

VSC-Azure Extension shows "Accounts and tenants" at the bottom of the left column

Two "tenants?" "accounts?" are show with the same name, but different hex numbers.

What is a "tenant?" what is an "account?"

In my Azure portal, I have a TriSplit "Subscription" that shows a hex "Subscription ID" that does not match either of the tenant numbers in the VSC Azure extension. HOWEVER, there is a "Parent Management Group" hex number that does match one of the tenant hex numbers in VSC/Azure extension. In my Azure portal, I have a B2C tenant, an App Service Plan, a subscription, an App Service, 2 Resource Groups, and an Action Group. I don't know how this is all connected and organized. I had been publishing just fine before, but now it doesn't. The terminology and plans are confusing.

Do you have an explanation?
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-20T11:20:08.5466667+00:00
Hello Stephen Hollister,

Thank you for the detailed explanation — I understand how confusing this can be, especially since it was working earlier.

To clarify, this is not an application, MSAL, or clientId issue. App registrations do not expire, and the clientId you’re seeing during publish belongs to Microsoft’s VS Code / Azure tooling, not your application, which is why it does not appear in your Azure portal.

The publish is failing due to Azure tenant and RBAC (permissions) context, not because anything changed in your code.

Here’s how the pieces fit together:

The Tenant IDs shown under Accounts & Tenants in VS Code represent Microsoft Entra ID directories, not subscriptions.

A Subscription ID will never match a Tenant ID (this is expected behavior).

The Parent Management Group ID matching the Tenant ID is also expected, since management groups are scoped at the tenant level.

Your app builds and the ZIP is created successfully, which confirms the local setup is fine.

The failure happens when VS Code tries to deploy — Microsoft Entra ID cannot issue a deployment token because the signed‑in account does not have sufficient Azure RBAC access on the target scope. What to check (this typically resolves the issue)

In the Azure Portal, go to the Subscription (or Resource Group) that contains the App Service.

Open Access control (IAM).

Verify that your account ******@trisplitinc.onmicrosoft.com has Contributor, Website Contributor, or Owner access.

After confirming or adding the role:

Sign out of VS Code

Restart VS Code

Sign back in with your TriSplit work account

Select the tenant that owns the subscription

Try publishing again.

No new app registrations are required, and there’s no need to clean up old learning resources unless they’re actively selected.
Stephen Hollister 5 Reputation points

2026-04-20T11:36:20.36+00:00

Thanks! I'll give that a try.
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-20T11:52:43.44+00:00

Stephen Hollister Please let me know once you've tried it, and feel free to reach out if you need any further assistance.
Stephen Hollister 5 Reputation points

2026-04-20T13:34:09.2766667+00:00

It still didn't work.

This is what I see and select when I use the Azure App Service to publish.

This is the error when I try to go to the website:

I can't find this app hex number (... 787cd) anywhere in my Azure portal.
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-20T14:03:07.61+00:00
Stephen Hollister Thanks for the screenshots — they confirm exactly what’s blocking the publish.

The hex ID you’re asking about (ending in 787cd) is not one of your applications and it will not appear anywhere in your Azure portal. That ID belongs to Microsoft’s internal VS Code / Azure App Service deployment app, which VS Code uses automatically. This part is expected and not something you manage.

The actual issue is this line from the sign‑in prompt: “Selected user account does not exist in tenant ‘TriSplit, Inc’.”

VS Code is deploying to the TriSplit tenant, but the account you’re signing in with (******@trisplit.com) does not exist in that tenant as a member or guest. Even though your role shows Owner, tenant membership is validated before RBAC roles are checked, so Entra ID blocks the deployment and the publish is cancelled.

This usually works until:

a guest account is removed,

a different account is used to sign in,

or VS Code starts using a cached account that no longer has tenant access.

To resolve this, you need to do one of the following:

Sign into VS Code using ******@trisplitinc.onmicrosoft.com, or

Add ******@trisplit.com as a guest user in the TriSplit tenant and then retry the publish.

No app registrations, client IDs, or code changes are required. Once the signing account exists in the tenant, publishing will work again.
Stephen Hollister 5 Reputation points

2026-04-20T14:09:54.42+00:00

Thanks! I will try it this afternoon.
Stephen Hollister 5 Reputation points

2026-04-20T17:06:22.4733333+00:00

I checked and I'm signed into the proper account in VSC.

This is what I see when I click on the person icon in the lower left

This is what shows up when I select the Azure extension tab
When I click to publish to the website, this is my only choice - and that is what I used to see when it did work.

I believe that it IS some sort of account mismatch, but I still don't see it. Am I missing something simple and stupid?

Thanks again for your help.
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-21T10:26:22.17+00:00

Stephen Hollister Thank you for letting me know. I understand and will look into this further. I'll keep you updated.
Stephen Hollister 5 Reputation points

2026-04-21T10:46:02.65+00:00

Thanks!!!
Stephen Hollister 5 Reputation points

2026-04-21T23:09:16.2066667+00:00

Any answers? My website started with Microsoft AD that is now Entra, so is there some addition or change in authorization. Do I have to set something new up?
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-22T08:00:11.0266667+00:00

Stephen Hollister There haven’t been any breaking changes in Microsoft Entra ID (formerly Azure AD) that require new setup for App Service publishing, and nothing in your application or MSAL configuration needs to change.

The publish failure is happening because VS Code is attempting to deploy using a cached account/tenant context that doesn’t fully align with the tenant that owns your subscription. Even though the correct account appears signed in, Entra ID still blocks the deployment token if the signed‑in identity does not exist as a valid member in that tenant at deploy time.
Praneeth Maddali 8,775 Reputation points Microsoft External Staff Moderator

2026-04-22T09:22:03.9133333+00:00

HI @Stephen Hollister

There appears to be a tenant mismatch. Please verify that the user account is associated with the tenant where you’re deploying the app. Also, ensure you’ve selected the correct tenant in Visual Studio Code.
Stephen Hollister 5 Reputation points

2026-04-22T13:36:00.11+00:00

I've re-checked everything and it still doesn't work. I'm matching up what I see on my portal and in VSC/Azure

Account: ******@TriSplitInc.onmicrosoft.com

B2C Tenant: trisplit.onmicrosoft.com ... ID: 0c61 ..... 4147e3

Resource group: appsvc_linux_centralus_basic

When I go to publish from VSC using the Azure App Service, I get this:

I select the "subscription" TriSplit (.... f3e2d) and hit OK, then nothing happens.

If I select BOTH of these "tenants?" (the top number is really a "Parent Management Group" number

Then I get this when I select publish:

Select a "resource" (this is what I've always seen), and when I select the resource, I get this (as I've always seen)

I click on "Deploy" and get the same failure - build and zip are OK, but the upload failed.

"Even though the correct account appears signed in, Entra ID still blocks the deployment token if the signed‑in identity does not exist as a valid member in that tenant at deploy time."

I'm not sure what to do next. Publishing worked fine last December (or so) and now it doesn't.

BTW, this should be published to my website: https://trisplit.com but failed - so now the website is down. I get this:

It seems to make the connection to my Azure account (because the website was changed to this), but it couldn't upload the new zipped changes. Is there some authorization code or token that became outdated? I believe it was Dec. 2022 when I first uploaded to https://trisplit.com, and have I been publishing changes successfully since then.

I really need to get my MVP site up and going again. Thanks for any help you can give. If this needs to be escalated to a different level, I'm willing to pay if need be.
Stephen Hollister 5 Reputation points

2026-04-23T10:26:45.4366667+00:00

Could the problem be related to my use of AD B2C authorization? I know that it is being deprecated, but I see that we have until May 2030 before we need to change to Entra External ID. Does AD B2C use tokens that expire? I've just begun looking at this. I would like to keep my MVP online until we figure out what our tech stack future will be. We use morgan, passport, and passport-azure-ad.
Praneeth Maddali 8,775 Reputation points Microsoft External Staff Moderator

2026-04-27T12:18:28.0966667+00:00

Hi @Stephen Hollister

Just following up to see if your issue has been resolved or if you had a chance to review my earlier comment?
Stephen Hollister 5 Reputation points

2026-05-01T14:20:35.6+00:00
I'm back from travel, but the problem persists. Azure App Service in VSC builds the zip for upload but then aborts with no details I can find. My website https://trisplit.com is erased, but the publish doesn't work.

9:56:01 AM TriSplit: Using intermediate directory '/tmp/8dea78958c39ec0'. 9:56:01 AM TriSplit: Copying files to the intermediate directory... 9:56:15 AM: Error: The operation was aborted. Rejecting from abort signal callback while making request.

I believe I have the links set up correctly because it removed the previously-published website.

Any new ideas?

1 answer

Your answer

VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-17T13:03:41.11+00:00

Hello Stephen Hollister,

I understand why it looks like a key / clientId / authorization issue, but based on what you’ve shared, nothing in your application’s msalConfig has expired or changed.

Here’s what’s actually happening:

Your app builds successfully and the ZIP file is created, which confirms your code and local configuration are fine.

The failure happens during the upload step, before deployment completes.

The clientId you’re noticing (the GUID shown during sign‑in) is not your app registration. It belongs to the VS Code / Azure tooling authentication app, which is why you won’t find it in your Azure portal — and that is expected behavior.

The deployment is being cancelled because the account currently signed into VS Code does not exist (as a member or guest) in the target tenant. When Microsoft Entra ID can’t issue an access token for that tenant, the request is aborted, which is why you see the “operation was aborted” message.

This also explains why it worked before:

You were likely signed in with a different account at that time, or

Your account previously had access to the tenant and later lost it, or

VS Code is now automatically using a cached account that doesn’t have tenant access.

What to check :

Please ensure that:

The account which has access to your Azure resources appears in the VS Code Accounts menu

Under Azure → Accounts & Tenants, the correct tenant is selected

If you’re using a personal Microsoft account, it must be added as a guest user to the tenant, or you should sign in using the correct work/school account

No changes are required to your application code or MSAL configuration. Once VS Code is authenticated with an account that actually belongs to the tenant, the ZIP upload and deployment should succeed again.
Stephen Hollister 5 Reputation points

2026-04-17T13:50:36.63+00:00

My process worked 6 or so months ago and I did not change anything. Interestingly, my Azure portal shows NO app registrations?!? Do they expire? It seems like I need to register a new application (#3) and put in a new clientId, but I'm concerned that I will screw it up more. Can I pay someone to do it for me and perhaps clean up my account and offer advice?
Stephen Hollister 5 Reputation points

2026-04-17T14:20:10.74+00:00

Thanks, but I don't see "Accounts & Tenants." I see these choices:

I use a corporate account for TriSplit. I find the terminology confusing: tenant, subscription, client, app registration and more. In addition, I still have old "learning" stuff left over that I'm afraid to delete or clean up.
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-17T14:58:17.0466667+00:00

Stephen Hollister App registrations do not expire, and you don’t need to create a new one for publishing to Azure App Service from VS Code. The clientId you’re seeing is not your application’s app registration — it belongs to Microsoft’s built‑in VS Code / Azure tooling, which is why it doesn’t appear in your Azure portal. This is expected behavior.

The publish failure is occurring because VS Code is currently signed in with an account that doesn’t have access to the tenant/subscription where the App Service exists. When Microsoft Entra ID can’t issue an access token for that tenant, the ZIP upload is aborted, even though the build succeeds.

Recommended steps:

In VS Code, sign out of all accounts.

Restart VS Code.

Sign in again using your TriSplit work/school account.

Open the Azure extension and confirm the correct subscription is selected and the App Service appears.

Try publishing again.

No changes are required to your MSAL configuration or application code, and you don’t need to create a new app registration. Old learning resources or tenants can be safely ignored unless they’re actively selected.

If the App Service still doesn’t appear after re‑signing in, it means the signed‑in account doesn’t have access to that tenant, which would need to be addressed.

Please let me know if this helps or if you still see issues after trying the above.

Note: Just to confirm, are you signed into VS Code with the correct TriSplit work/school account and targeting the same tenant/subscription where the App Service exists? Also, please verify your account has the required role (Contributor / Website Contributor / Owner) on the App Service or its resource group. If the account, tenant, or role doesn’t match, the ZIP build succeeds but the publish gets cancelled.
Stephen Hollister 5 Reputation points

2026-04-17T17:07:35.9433333+00:00

I found Accounts & Tenants at the bottom and I have two tenants. I changed to the other (correct?) one, but the Publishing doesn't work. I select the subscription and it does nothing and I get no prompt to verify the publishing. Any advice?
Stephen Hollister 5 Reputation points

2026-04-17T17:17:25.1266667+00:00

I will give your latest advice a try.
Stephen Hollister 5 Reputation points

2026-04-17T19:40:49.07+00:00

I signed out and in of VSC and my Azure portal and then signed back in. Nether of the two "Accounts & Tenants" numbers in the VSC Azure Portal Extension match my Azure Portal account "Subscription ID." What are the Accounts & Tenants numbers? Is it not the subscription number? This used to work in the past and I made no changes. I tried publishing again and get the same failed result.
Stephen Hollister 5 Reputation points

2026-04-20T10:59:31.4433333+00:00

3. Sign in again using your TriSplit work/school account.

4. Open the Azure extension and confirm the correct subscription is selected and the App Service appears.

VSC account matches the Azure Extension account. ******@trisplitinc.onmicrosoft.com

VSC-Azure Extension shows "Accounts and tenants" at the bottom of the left column

Two "tenants?" "accounts?" are show with the same name, but different hex numbers.

What is a "tenant?" what is an "account?"

In my Azure portal, I have a TriSplit "Subscription" that shows a hex "Subscription ID" that does not match either of the tenant numbers in the VSC Azure extension. HOWEVER, there is a "Parent Management Group" hex number that does match one of the tenant hex numbers in VSC/Azure extension. In my Azure portal, I have a B2C tenant, an App Service Plan, a subscription, an App Service, 2 Resource Groups, and an Action Group. I don't know how this is all connected and organized. I had been publishing just fine before, but now it doesn't. The terminology and plans are confusing.

Do you have an explanation?
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-20T11:20:08.5466667+00:00

Hello Stephen Hollister,

Thank you for the detailed explanation — I understand how confusing this can be, especially since it was working earlier.

To clarify, this is not an application, MSAL, or clientId issue. App registrations do not expire, and the clientId you’re seeing during publish belongs to Microsoft’s VS Code / Azure tooling, not your application, which is why it does not appear in your Azure portal.

The publish is failing due to Azure tenant and RBAC (permissions) context, not because anything changed in your code.

Here’s how the pieces fit together:

The Tenant IDs shown under Accounts & Tenants in VS Code represent Microsoft Entra ID directories, not subscriptions.

A Subscription ID will never match a Tenant ID (this is expected behavior).

The Parent Management Group ID matching the Tenant ID is also expected, since management groups are scoped at the tenant level.

Your app builds and the ZIP is created successfully, which confirms the local setup is fine.

The failure happens when VS Code tries to deploy — Microsoft Entra ID cannot issue a deployment token because the signed‑in account does not have sufficient Azure RBAC access on the target scope. What to check (this typically resolves the issue)

In the Azure Portal, go to the Subscription (or Resource Group) that contains the App Service.

Open Access control (IAM).

Verify that your account ******@trisplitinc.onmicrosoft.com has Contributor, Website Contributor, or Owner access.

After confirming or adding the role:

Sign out of VS Code

Restart VS Code

Sign back in with your TriSplit work account

Select the tenant that owns the subscription

Try publishing again.

No new app registrations are required, and there’s no need to clean up old learning resources unless they’re actively selected.
Stephen Hollister 5 Reputation points

2026-04-20T11:36:20.36+00:00

Thanks! I'll give that a try.
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-20T11:52:43.44+00:00

Stephen Hollister Please let me know once you've tried it, and feel free to reach out if you need any further assistance.
Stephen Hollister 5 Reputation points

2026-04-20T13:34:09.2766667+00:00

It still didn't work.

This is what I see and select when I use the Azure App Service to publish.

This is the error when I try to go to the website:

I can't find this app hex number (... 787cd) anywhere in my Azure portal.
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-20T14:03:07.61+00:00

Stephen Hollister Thanks for the screenshots — they confirm exactly what’s blocking the publish.

The hex ID you’re asking about (ending in 787cd) is not one of your applications and it will not appear anywhere in your Azure portal. That ID belongs to Microsoft’s internal VS Code / Azure App Service deployment app, which VS Code uses automatically. This part is expected and not something you manage.

The actual issue is this line from the sign‑in prompt: “Selected user account does not exist in tenant ‘TriSplit, Inc’.”

VS Code is deploying to the TriSplit tenant, but the account you’re signing in with (******@trisplit.com) does not exist in that tenant as a member or guest. Even though your role shows Owner, tenant membership is validated before RBAC roles are checked, so Entra ID blocks the deployment and the publish is cancelled.

This usually works until:

a guest account is removed,

a different account is used to sign in,

or VS Code starts using a cached account that no longer has tenant access.

To resolve this, you need to do one of the following:

Sign into VS Code using ******@trisplitinc.onmicrosoft.com, or

Add ******@trisplit.com as a guest user in the TriSplit tenant and then retry the publish.

No app registrations, client IDs, or code changes are required. Once the signing account exists in the tenant, publishing will work again.
Stephen Hollister 5 Reputation points

2026-04-20T14:09:54.42+00:00

Thanks! I will try it this afternoon.
Stephen Hollister 5 Reputation points

2026-04-20T17:06:22.4733333+00:00

I checked and I'm signed into the proper account in VSC.

This is what I see when I click on the person icon in the lower left

This is what shows up when I select the Azure extension tab
When I click to publish to the website, this is my only choice - and that is what I used to see when it did work.

I believe that it IS some sort of account mismatch, but I still don't see it. Am I missing something simple and stupid?

Thanks again for your help.
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-21T10:26:22.17+00:00

Stephen Hollister Thank you for letting me know. I understand and will look into this further. I'll keep you updated.
Stephen Hollister 5 Reputation points

2026-04-21T10:46:02.65+00:00

Thanks!!!
Stephen Hollister 5 Reputation points

2026-04-21T23:09:16.2066667+00:00

Any answers? My website started with Microsoft AD that is now Entra, so is there some addition or change in authorization. Do I have to set something new up?
VEMULA SRISAI 12,615 Reputation points Microsoft External Staff Moderator

2026-04-22T08:00:11.0266667+00:00

Stephen Hollister There haven’t been any breaking changes in Microsoft Entra ID (formerly Azure AD) that require new setup for App Service publishing, and nothing in your application or MSAL configuration needs to change.

The publish failure is happening because VS Code is attempting to deploy using a cached account/tenant context that doesn’t fully align with the tenant that owns your subscription. Even though the correct account appears signed in, Entra ID still blocks the deployment token if the signed‑in identity does not exist as a valid member in that tenant at deploy time.
Praneeth Maddali 8,775 Reputation points Microsoft External Staff Moderator

2026-04-22T09:22:03.9133333+00:00

HI @Stephen Hollister

There appears to be a tenant mismatch. Please verify that the user account is associated with the tenant where you’re deploying the app. Also, ensure you’ve selected the correct tenant in Visual Studio Code.
Stephen Hollister 5 Reputation points

2026-04-22T13:36:00.11+00:00

I've re-checked everything and it still doesn't work. I'm matching up what I see on my portal and in VSC/Azure

Account: ******@TriSplitInc.onmicrosoft.com

B2C Tenant: trisplit.onmicrosoft.com ... ID: 0c61 ..... 4147e3

Resource group: appsvc_linux_centralus_basic

When I go to publish from VSC using the Azure App Service, I get this:

I select the "subscription" TriSplit (.... f3e2d) and hit OK, then nothing happens.

If I select BOTH of these "tenants?" (the top number is really a "Parent Management Group" number

Then I get this when I select publish:

Select a "resource" (this is what I've always seen), and when I select the resource, I get this (as I've always seen)

I click on "Deploy" and get the same failure - build and zip are OK, but the upload failed.

"Even though the correct account appears signed in, Entra ID still blocks the deployment token if the signed‑in identity does not exist as a valid member in that tenant at deploy time."

I'm not sure what to do next. Publishing worked fine last December (or so) and now it doesn't.

BTW, this should be published to my website: https://trisplit.com but failed - so now the website is down. I get this:

It seems to make the connection to my Azure account (because the website was changed to this), but it couldn't upload the new zipped changes. Is there some authorization code or token that became outdated? I believe it was Dec. 2022 when I first uploaded to https://trisplit.com, and have I been publishing changes successfully since then.

I really need to get my MVP site up and going again. Thanks for any help you can give. If this needs to be escalated to a different level, I'm willing to pay if need be.
Stephen Hollister 5 Reputation points

2026-04-23T10:26:45.4366667+00:00

Could the problem be related to my use of AD B2C authorization? I know that it is being deprecated, but I see that we have until May 2030 before we need to change to Entra External ID. Does AD B2C use tokens that expire? I've just begun looking at this. I would like to keep my MVP online until we figure out what our tech stack future will be. We use morgan, passport, and passport-azure-ad.
Praneeth Maddali 8,775 Reputation points Microsoft External Staff Moderator

2026-04-27T12:18:28.0966667+00:00

Hi @Stephen Hollister

Just following up to see if your issue has been resolved or if you had a chance to review my earlier comment?
Stephen Hollister 5 Reputation points

2026-05-01T14:20:35.6+00:00

I'm back from travel, but the problem persists. Azure App Service in VSC builds the zip for upload but then aborts with no details I can find. My website https://trisplit.com is erased, but the publish doesn't work.

9:56:01 AM TriSplit: Using intermediate directory '/tmp/8dea78958c39ec0'. 9:56:01 AM TriSplit: Copying files to the intermediate directory... 9:56:15 AM: Error: The operation was aborted. Rejecting from abort signal callback while making request.

I believe I have the links set up correctly because it removed the previously-published website.

Any new ideas?

Answer 1

The failure is consistent with an authentication/authorization issue rather than a problem with the App Service itself.

The error dialog shows that the signed‑in user account no longer exists in (or no longer has access to) the Azure AD tenant that owns the application with the given clientId. That means the app registration (the clientId in msalConfig) is in a tenant where this account is not a member or guest anymore, so interactive sign‑in for publishing cannot complete and the VS Code Azure App Service extension aborts the deployment.

To restore publishing, use one of these approaches:

Sign in with an account that belongs to the correct tenant
When the Azure sign‑in prompt appears, choose Use another account and sign in with the account that actually belongs to the tenant that owns the application/clientId. Once authenticated, retry the Deploy to Web App operation.
Add the current account as a guest/external user in that tenant
In the Azure portal for the tenant that owns the app registration, add the current user as a guest and grant it access to the subscription/resource group/App Service. After that, sign out and sign back in from VS Code and redeploy.
Create or use a new app registration and update configuration
If the original app registration is no longer valid or accessible, create a new app registration in the tenant where the current account has access, then update the clientId in msalConfig (and any related configuration) to use the new registration. Ensure the app registration has the required permissions and that the account has access to the App Service resources.
Verify service principal / role assignments if using a service connection
If deployment uses a service principal behind the scenes, confirm in Azure portal that the service principal (from the app registration) still exists, is not expired, and has appropriate role assignments (for example, Contributor) on the subscription or resource group that contains the App Service. If it expired, create a new credential or a new service principal and update the deployment configuration accordingly.

Once the account/tenant mismatch is resolved and the app registration is valid and accessible, the VS Code Azure App Service extension should be able to authenticate and complete the zip deploy successfully.

References:

Share via

VSC Azure App Service extension to Publish fails now

1 answer

Your answer