Azure存储帐户拒绝托管服务标识的颁发者

我是 using the Microsoft.Azure.Services.AppAuthentication library (v1.0.3) for .NET 使用托管服务标识从Azure功能应用连接到blob存储。身份验证代码:

var tokenProvider = new AzureServiceTokenProvider();
string accessToken = await tokenProvider.GetAccessTokenAsync("https://storage.azure.com/");
var tokenCredential = new TokenCredential(accessToken);
var credentials = new StorageCredentials(tokenCredential);
var storageUri = new Uri($"https://{accountName}.blob.core.windows.net");
var client = new CloudBlobClient(storageUri, credentials);

一个现有的存储帐户拒绝接受MSI,而不管给定的RBAC角色:

Microsoft.WindowsAzure.Storage.StorageException: Server failed to authenticate the request.
Make sure the value of Authorization header is formed correctly including the signature.
   at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.ExecuteAsyncInternal[T](RESTCommand`1 cmd, IRetryPolicy policy, OperationContext operationContext, CancellationToken token)
   at Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer.CreateIfNotExistsAsync(BlobContainerPublicAccessType accessType, BlobRequestOptions options, OperationContext operationContext, CancellationToken cancellationToken)

其他异常详细信息 storageException.RequestInformation.ExtendedErrorInformation.AdditionalDetails 抱怨 AuthenticationErrorDetail: Issuer validation failed. Issuer did not match.

解码失败的jwt令牌时,颁发者看起来正常:

{
  "aud": "https://storage.azure.com/",
  "iss": "https://sts.windows.net/<my directory guid>/",
  ...
}

当我创建新的完全相同的存储帐户时,相同的函数app MSI和auth代码工作,甚至token中的发行者也是完全相同的。所以客户端函数应用程序和它的MSI标识不是罪魁祸首。

为什么这个存储帐户无法授权,以及如何让它接受MSI?

更新: Cross posted to MS forum 在验证这是否是azure错误时引起MS的注意。