`aspire deploy` Azure SQL role provisioning fails in Azure PowerShell 14 with MemoryCache MissingMethodException

[Juulsn]

Is there an existing issue for this?

• I have searched the existing issues

Related issues describe failures in the same Azure SQL role-provisioning path, but not this exception:

• Azure Sql Provisioning Stopped Working #9926
• Aspire Azure SQL provisioning fails #13683

Describe the bug

aspire deploy consistently fails while provisioning an Azure SQL database role for a project managed identity.

Public minimal reproduction, verified against Azure before filing this issue:

https://github.com/Juulsn/aspire-azure-sql-role-provisioning-repro

The isolated reproduction contains one web project and one Azure SQL database reference. Azure SQL, the managed identity, ACR, and the Container Apps environment all provision successfully. Only provision-web-roles-sql and the enclosing pipeline fail.

The Azure deployment script generated by Aspire.Hosting.Azure.Sql 13.4.6 uses Azure PowerShell 14.0 and contains:

# Install SqlServer module - using specific version to avoid breaking changes in 22.4.5.1
Install-Module -Name SqlServer -RequiredVersion 22.3.0 -Force -AllowClobber -Scope CurrentUser
Import-Module SqlServer

Each call to Invoke-Sqlcmd fails with:

System.MissingMethodException: Method not found:
'Void Microsoft.Extensions.Caching.Memory.MemoryCache..ctor(
Microsoft.Extensions.Options.IOptions`1<
Microsoft.Extensions.Caching.Memory.MemoryCacheOptions>)'.

The generated script retries Invoke-Sqlcmd five times. The role-provisioning step reaches its terminal failed state after approximately 6 minutes 39 seconds. aspire deploy exits with code 6; 20 of 22 pipeline steps succeed.

The exception is raised inside Invoke-Sqlcmd while registering Always Encrypted providers, before the generated SQL query appears to reach Azure SQL. It therefore reproduces without any existing application data or database users/roles.

This appears to be a binary compatibility or assembly-loading problem between the pinned SqlServer PowerShell module 22.3.0 and the Azure PowerShell 14 deployment-script runtime. I cannot prove a specific Azure runtime image rollout because the deployment operation exposes azPowerShellVersion: 14.0, but not the underlying image tag or digest.

Separately, an application deployment using the same Aspire versions and the same generated SQL-role ARM template hash succeeded on 2026-07-20 at approximately 13:38 UTC and started failing later that day at approximately 22:48 UTC. There were no intervening changes to the AppHost, Aspire packages, or generated infrastructure. The same exception was reproduced by three CI retries, a local deployment of that application, and finally the isolated public reproduction above.

Expected Behavior

aspire deploy should create the project managed identity as an Azure SQL user and assign its database role.

The generated deployment script should select a SqlServer PowerShell module version that is compatible with the selected Azure PowerShell deployment-script runtime. Installation and import should select the same explicit version to avoid an unintended module mismatch, for example:

Install-Module SqlServer -RequiredVersion <compatible-version> ...
Import-Module SqlServer -RequiredVersion <compatible-version> -Force

The selected combination should be tested by actually invoking Invoke-Sqlcmd, since installing or importing the module alone may not exercise the incompatible Always Encrypted assembly path.

Steps To Reproduce

Clone the public minimal reproduction:

git clone https://github.com/Juulsn/aspire-azure-sql-role-provisioning-repro.git
cd aspire-azure-sql-role-provisioning-repro

Follow the resource-group setup in the repository README, then run:

aspire deploy \
  --apphost AppHost/AppHost.csproj \
  --environment Production \
  --non-interactive

The deployment reaches provision-web-roles-sql, retries five times, and fails with the exception below. The README includes an explicit cleanup command for the isolated resource group.

Exceptions (if any)

Aspire.Hosting.Azure.ProvisioningFailedException:
Deployment failed: Error code = DeploymentScriptError, Message =
System.MissingMethodException: Method not found:
'Void Microsoft.Extensions.Caching.Memory.MemoryCache..ctor(
Microsoft.Extensions.Options.IOptions`1<
Microsoft.Extensions.Caching.Memory.MemoryCacheOptions>)'.

   at Microsoft.SqlServer.Management.AlwaysEncrypted.Management.SqlAKVProviderWithDisposableCache..ctor(TokenCredential tokenCredential)
   at Microsoft.SqlServer.Management.AlwaysEncrypted.Management.AlwaysEncryptedManagement.SetCustomProvidersWithDisposableCache(Boolean useGlobalCredential)
   at Microsoft.SqlServer.Management.PowerShell.Shared.AzureKeyVaultUtilities.RegisterCustomKeyStoreProviders(String keyVaultAccessToken, String managedHsmAccessToken, SqlConnection conn)
   at Microsoft.SqlServer.Management.PowerShell.GetScriptCommand.ProcessRecord()
   at <ScriptBlock>, /mnt/azscripts/azscriptinput/userscript.ps1: line 41
   at <ScriptBlock>, <No file>: line 1
   at <ScriptBlock>, /mnt/azscripts/azscriptinput/DeploymentScript.ps1: line 321

Aspire doctor output

{
  "checks": [
    {
      "category": "aspire",
      "name": "cli-version",
      "status": "pass",
      "message": "Aspire CLI version 13.4.6 (channel: stable)"
    },
    {
      "category": "apphost",
      "name": "apphost-version",
      "status": "pass",
      "message": "AppHost version 13.4.6 (AppHost/AppHost.csproj)"
    },
    {
      "category": "sdk",
      "name": "dotnet-sdk",
      "status": "pass",
      "message": ".NET 10.0.201 installed (arm64)"
    },
    {
      "category": "environment",
      "name": "dev-certs",
      "status": "pass",
      "message": "HTTPS development certificate is trusted"
    },
    {
      "category": "container",
      "name": "docker",
      "status": "pass",
      "message": "Docker v29.5.2: running"
    }
  ],
  "summary": {
    "passed": 5,
    "warnings": 0,
    "failed": 0
  }
}

Anything else?

Verified environment:

• Aspire CLI: 13.4.6+87fe259e4fc244c599019a7b1304c85a1488f248
• Aspire.AppHost.Sdk: 13.4.6
• Aspire.Hosting.Azure.Sql: 13.4.6
• .NET SDK: 10.0.201
• .NET runtime: 10.0.5
• Local OS: macOS, arm64
• Container runtime: Docker 29.5.2
• Azure region: West Europe
• Generated deployment-script runtime: Azure PowerShell 14.0
• Generated SqlServer PowerShell module: 22.3.0
• Minimal reproduction deployment date: 2026-07-21
• SQL-role deployment template hash: 5890327519641588324

The relevant generated script is currently defined here:

aspire/src/Aspire.Hosting.Azure.Sql/AzureSqlServerResource.cs

Lines 323 to 331 in 4f1eb9c

	scriptResource.ScriptContent = $$"""
	$sqlServerFqdn = "$env:DBSERVER"
	$sqlDatabaseName = "$env:DBNAME"
	$principalName = "$env:PRINCIPALNAME"
	$id = "$env:ID"
	# Install SqlServer module - using specific version to avoid breaking changes in 22.4.5.1 (see https://github.com/microsoft/aspire/issues/9926)
	Install-Module -Name SqlServer -RequiredVersion 22.3.0 -Force -AllowClobber -Scope CurrentUser
	Import-Module SqlServer

The current 22.3.0 pin was introduced after the different compatibility failure reported in #9926. It may need to be revalidated against the current Azure PowerShell 14 deployment-script runtime.

[joperezr]

🤖 Aspire triage pass — 2026-07-21 13:29 UTC

Area: area-integrations, area-deployment
Kind: bug
Repro: yes-minimal — public minimal repro linked, plus "Steps To Reproduce" section in the body
Affected version(s): 13.4.6 (stable). Reporter notes the same 13.4.6 + same template hash succeeded hours earlier the same day and then began failing — no Aspire/infra changes in between.
Severity: S2 — core aspire deploy Azure SQL managed-identity role provisioning is broken with no workaround (Invoke-Sqlcmd throws MissingMethodException on MemoryCache..ctor while registering Always Encrypted providers).

Urgency: 🟡 vNext — recommend milestone 13.5
Reason: S2, broken core deploy scenario with no workaround, but NOT a confirmed 13.4 code regression — the reporter's own evidence (identical Aspire 13.4.6 and generated template hash worked earlier the same day, failed later with no changes) points to an external Azure PowerShell 14 deployment-script runtime rollout rather than an Aspire 13.4 change. The SqlServer 22.3.0 module pin predates 13.4 (introduced after #9926). Regression baseline is external/unclear, so this does not meet the 13.4.x servicing (regression-only) bar. Flagging for human to consider whether a 13.4.x re-pin is warranted, since the fix (selecting a SqlServer module version compatible with the current AzPowerShell 14 runtime) is shippable in servicing.

Suggested owner(s): @eerhardt (CODEOWNERS), backup @mitchdenny (CODEOWNERS)
Evidence:

• The failing code is the hosting-side generated provisioning script in src/Aspire.Hosting.Azure.Sql/AzureSqlServerResource.cs (cited file verified to exist).
• No Aspire.Hosting.Azure.Sql-specific CODEOWNERS entry exists; it inherits /src/Aspire.Hosting.Azure → @eerhardt @mitchdenny.
• Related recent area work: Reference Microsoft.Data.SqlClient.Extensions.Azure in SqlServer client integrations for Entra ID auth #18149 (SqlServer client Entra ID auth) — client-side, tangential to the hosting provisioning script, so weighted below CODEOWNERS.

Confidence: medium
Needs human?: yes — possible 13.4.x servicing candidate (broken core deploy, no workaround) but the regression baseline points to an external Azure runtime rollout, not a confirmed 13.4 code regression; a human should confirm the target milestone.

Dry-run mode — no labels or milestone applied. Reply /triage apply to promote, or edit and reapply.

[Juulsn]

Additional evidence: this appears to be another manifestation of Azure/azure-powershell#29833.

The Azure PowerShell 14 deployment-script image now contains Az.Accounts 5.5.1, which upgraded Microsoft.Extensions.Options to 10.0.0.0. When loaded together with SqlServer 22.3.0, this causes the reported MemoryCache MissingMethodException.

I reproduced the exact exception by importing Az.Accounts 5.5.1 before invoking SqlServer 22.3.0.

[BOBx5]

This issue ruined our company's deployment pipeline.
I hope this issue can be dealt with ASAP.

[Juulsn]

@BOBx5 use this workaround:

builder.Services.Configure<AzureProvisioningOptions>(options =>
    options.ProvisioningBuildOptions.InfrastructureResolvers.Add(
        new AzureSqlPowerShellModuleWorkaround()));

(in AppHost)

internal sealed class AzureSqlPowerShellModuleWorkaround : InfrastructureResolver
{
    private const string SqlServerInstall = "Install-Module -Name SqlServer -RequiredVersion 22.3.0";

    public override IEnumerable<Provisionable> ResolveResources(
        IEnumerable<Provisionable> resources,
        ProvisioningBuildOptions options)
    {
        var resolvedResources = resources.ToArray();

        foreach (var script in resolvedResources.OfType<AzurePowerShellScript>())
        {
            if (script.ScriptContent.Value is not { } content ||
                !content.Contains(SqlServerInstall, StringComparison.Ordinal))
                continue;

            // Temporary workaround for https://github.com/microsoft/aspire/issues/18845.
            script.ScriptContent.Assign(new BicepValue<string>(content
                .Replace("-RequiredVersion 22.3.0", "-RequiredVersion 22.4.5.1")
                .Replace("Import-Module SqlServer", "Import-Module SqlServer -RequiredVersion 22.4.5.1 -Force")));
        }

        return base.ResolveResources(resolvedResources, options);
    }
}

[joperezr]

🤖 Re-triage under updated milestone bars (2026-07): setting milestone 13.5 — S2 core scenario: aspire deploy Azure SQL role provisioning fails deterministically via the Aspire-generated deployment script, with no workaround.