A plug-in that uses Power Platform managed identity acquires tokens successfully in the development environment. After the solution is imported into the test environment, token acquisition fails with AADSTS700213: No matching federated identity record found. The same signed assembly and Entra app registration are used. What is the most likely cause?

With Power Platform managed identity, the Entra ID app registration or user-assigned managed identity trusts the plug-in through a federated identity credential whose subject identifier encodes the tenant, the component type, the environment ID and a hash derived from the signing certificate. At runtime Dataverse presents a subject computed from the current environment, so when the plug-in runs in test, the subject contains the test environment's ID. If the only credential configured on the app references the development environment, Entra ID finds no matching federated identity record and returns AADSTS700213. Adding a federated credential with the test environment's ID, and ensuring the managed identity record exists in test, resolves it. Linking the assembly to a managed identity record in test is required, not a conflict; each environment holds its own record and link. A scope ending in /.default is the standard way to request a token for a resource and is not tied to an environment. Managed identity does not use client secrets; adding one would not affect federated token exchange. Exam caveat: the same error appears when the hashed issuer or subject DN does not match the certificate actually used to sign the assembly, or the record's version does not match the credential format. Operational check: compare the subject shown in the error details with the configured federated credential and confirm the environment segment matches test.