401 Unauthorized from User Managed Identity when using azure-eslz Bicep Deployment Example Files

[seversen]

I am attempting to use the Bicep example files to fetch an IP address block from the Azure API and create a vnet using the address space provided by the API call. However, it doesn't appear that Azure IPAM supports the use of User Managed Identities for authentication. When I run the example deployment, I receive the following 401 Unauthorized error message:

New-AzSubscriptionDeployment @inputObject | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | 10:41:37 AM - The deployment 'alz-APIM-API-Deploy-20251001T1010473297Z' failed with error(s). Showing 1 out of 1 error(s). Status Message: At least one resource deployment operation failed. | Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details. (Code: DeploymentFailed) - The resource write operation failed to complete | successfully, because it reached terminal provisioning state 'failed'. (Code: ResourceDeploymentFailure) - The provided script failed with the following error: | Microsoft.PowerShell.Commands.HttpResponseException: Response status code does not indicate success: 401 (Unauthorized). at | System.Management.Automation.MshCommandRuntime.ThrowTerminatingError(ErrorRecord errorRecord) at <ScriptBlock>, /mnt/azscripts/azscriptinput/userscript.ps1: line 12 at <ScriptBlock>, <No file>: | line 1 at <ScriptBlock>, /mnt/azscripts/azscriptinput/DeploymentScript.ps1: line 321. Please refer to https://aka.ms/DeploymentScriptsTroubleshoot for more deployment script information. | (Code:DeploymentScriptError) CorrelationId: 48f59b00-e298-4f39-9457-31a10209984e

Has anyone successfully authenticated to the Azure IPAM APIs using a User Managed Identity?

[seversen]

The example bicep file is using a deprecated method for obtaining the token.

I removed this line:
$accessToken = ConvertTo-SecureString (Get-AzAccessToken -ResourceUrl $Env:IPAM_API_SCOPE).Token -AsPlainText

and replaced it with this line:
$accessToken = (Get-AzAccessToken -ResourceUrl $Env:IPAM_API_SCOPE -AsSecureString).token

Now my UAMI can authenticate and use the IPAM APIs successfully.

This was mentioned in the following issue: https://github.com/Azure/ipam/issues/343