After a deploy, managed identities for a housing AI API fail Key Vault gets. What alert should ops configure?

After a deploy, if managed identities for a housing AI API fail Key Vault gets, operations should alert on spikes in Key Vault authorization denials that indicate misconfigured managed identities. A surge of Forbidden/unauthorized results right after deploy is a strong signal that RBAC assignments, identity binding, or secret references broke—exactly the failure mode that takes housing AI features down even when the API process itself is "up."

Alerting only when Azure invoices arrive at month end is unrelated to identity authorization failures and far too slow. Alerting solely on ACR pull successes tracks image fetch, not vault authorization. Disabling Key Vault diagnostic logs to reduce storage cost removes the evidence stream required to detect and prove denial spikes.

Exam caveat: Authorization denials differ from network unreachable errors; both can block secret gets but need different fixes (RBAC vs private endpoint/DNS). System-assigned and user-assigned managed identities must match what the deploy configured. Alert thresholds should account for brief retry noise without ignoring a sustained post-deploy denial storm.

Operational check: Enable Key Vault diagnostic logs, create an alert on elevated authorization failures scoped to the housing AI identities, test by temporarily removing a get permission in a nonprod slot and confirming the alert fires, and after production deploys watch the denial tile during soak. Include identity name, secret name, and result code in the alert payload for fast remediation.