How to use managed identities for App Service and Azure Functions

1. Access your app's settings in the Azure portal under the Settings group in the left navigation pane.

2. Select Identity.

3. Within the System assigned tab, switch Status to On. Click Save.

   

Run the az webapp identity assign command to create a system-assigned identity:

az webapp identity assign --name myApp --resource-group myResourceGroup

For App Service

Run the Set-AzWebApp -AssignIdentity command to create a system-assigned identity for App Service:

Set-AzWebApp -AssignIdentity $true -Name <app-name> -ResourceGroupName <group-name> 

For Functions

Run the Update-AzFunctionApp -IdentityType command to create a system-assigned identity for a function app:

Update-AzFunctionApp -Name $functionAppName -ResourceGroupName $resourceGroupName -IdentityType SystemAssigned

An Azure Resource Manager template can be used to automate deployment of your Azure resources. To learn more about deploying to App Service and Functions, see Automating resource deployment in App Service and Automating resource deployment in Azure Functions.

Any resource of type Microsoft.Web/sites can be created with an identity by including the following property in the resource definition:

"identity": {
    "type": "SystemAssigned"
}

Adding the system-assigned type tells Azure to create and manage the identity for your application.

For example, a web app's template might look like the following JSON:

{
    "apiVersion": "2022-03-01",
    "type": "Microsoft.Web/sites",
    "name": "[variables('appName')]",
    "location": "[resourceGroup().location]",
    "identity": {
        "type": "SystemAssigned"
    },
    "properties": {
        "name": "[variables('appName')]",
        "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('hostingPlanName'))]",
        "hostingEnvironment": "",
        "clientAffinityEnabled": false,
        "alwaysOn": true
    },
    "dependsOn": [
        "[resourceId('Microsoft.Web/serverfarms', variables('hostingPlanName'))]"
    ]
}

When the site is created, it has the following additional properties:

"identity": {
    "type": "SystemAssigned",
    "tenantId": "<tenant-id>",
    "principalId": "<principal-id>"
}

The tenantId property identifies what Microsoft Entra tenant the identity belongs to. The principalId is a unique identifier for the application's new identity. Within Microsoft Entra ID, the service principal has the same name that you gave to your App Service or Azure Functions instance.

If you need to reference these properties in a later stage in the template, you can do so via the reference() template function with the 'Full' flag, as in this example:

{
    "tenantId": "[reference(resourceId('Microsoft.Web/sites', variables('appName')), '2018-02-01', 'Full').identity.tenantId]",
    "objectId": "[reference(resourceId('Microsoft.Web/sites', variables('appName')), '2018-02-01', 'Full').identity.principalId]",
}

First, you'll need to create a user-assigned identity resource.

1. Create a user-assigned managed identity resource according to these instructions.

2. In the left navigation for your app's page, scroll down to the Settings group.

3. Select Identity.

4. Select User assigned > Add.

5. Search for the identity you created earlier, select it, and select Add.

   

   Once you select Add, the app restarts.

1. Create a user-assigned identity.

   az identity create --resource-group <group-name> --name <identity-name>
   

2. Run the az webapp identity assign command to assign the identity to the app.

   az webapp identity assign --resource-group <group-name> --name <app-name> --identities <identity-id>
   

For App Service

Adding a user-assigned identity in App Service is currently not supported.

For Functions

1. Create a user-assigned identity.

   Install-Module -Name Az.ManagedServiceIdentity -AllowPrerelease
   $userAssignedIdentity = New-AzUserAssignedIdentity -Name $userAssignedIdentityName -ResourceGroupName <group-name>
   

2. Run the Update-AzFunctionApp -IdentityType UserAssigned -IdentityId command to assign the identity in Functions:

   Update-AzFunctionApp -Name <app-name> -ResourceGroupName <group-name> -IdentityType UserAssigned -IdentityId $userAssignedIdentity.Id
   

An Azure Resource Manager template can be used to automate deployment of your Azure resources. To learn more about deploying to App Service and Functions, see Automating resource deployment in App Service and Automating resource deployment in Azure Functions.

Any resource of type Microsoft.Web/sites can be created with an identity by including the following block in the resource definition, replacing <resource-id> with the resource ID of the desired identity:

"identity": {
    "type": "UserAssigned",
    "userAssignedIdentities": {
        "<resource-id>": {}
    }
}

Adding the user-assigned type tells Azure to use the user-assigned identity specified for your application.

For example, a web app's template might look like the following JSON:

{
    "apiVersion": "2022-03-01",
    "type": "Microsoft.Web/sites",
    "name": "[variables('appName')]",
    "location": "[resourceGroup().location]",
    "identity": {
        "type": "UserAssigned",
        "userAssignedIdentities": {
            "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('identityName'))]": {}
        }
    },
    "properties": {
        "name": "[variables('appName')]",
        "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('hostingPlanName'))]",
        "hostingEnvironment": "",
        "clientAffinityEnabled": false,
        "alwaysOn": true
    },
    "dependsOn": [
        "[resourceId('Microsoft.Web/serverfarms', variables('hostingPlanName'))]",
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('identityName'))]"
    ]
}

When the site is created, it has the following additional properties:

"identity": {
    "type": "UserAssigned",
    "userAssignedIdentities": {
        "<resource-id>": {
            "principalId": "<principal-id>",
            "clientId": "<client-id>"
        }
    }
}

The principalId is a unique identifier for the identity that's used for Microsoft Entra administration. The clientId is a unique identifier for the application's new identity that's used for specifying which identity to use during runtime calls.

A raw HTTP GET request uses the two supplied environment variables and looks like the following example:

GET /MSI/token?resource=https://vault.azure.net&api-version=2019-08-01 HTTP/1.1
Host: <ip-address-:-port-in-IDENTITY_ENDPOINT>
X-IDENTITY-HEADER: <value-of-IDENTITY_HEADER>

And a sample response might look like the following:

HTTP/1.1 200 OK
Content-Type: application/json

{
    "access_token": "eyJ0eXAi…",
    "expires_on": "1586984735",
    "resource": "https://vault.azure.net",
    "token_type": "Bearer",
    "client_id": "00001111-aaaa-2222-bbbb-3333cccc4444"
}

This response is the same as the response for the Microsoft Entra service-to-service access token request. To access Key Vault, you will then add the value of access_token to a client connection with the vault.

For .NET apps and functions, the simplest way to work with a managed identity is through the Azure Identity client library for .NET. For detailed guidance, see Tutorial: Connect to Azure databases from App Service without secrets using a managed identity.

See the respective documentation headings of the client library for information:

• Add Azure Identity client library to your project
• Access Azure service with a system-assigned identity
• Access Azure service with a user-assigned identity

The linked examples use DefaultAzureCredential. It's useful for the majority of the scenarios because the same pattern works in Azure (with managed identities) and on your local machine (without managed identities).

For Node.js apps and JavaScript functions, the simplest way to work with a managed identity is through the Azure Identity client library for JavaScript. For detailed guidance, see Tutorial: Connect to Azure databases from App Service without secrets using a managed identity.

See the respective documentation headings of the client library for information:

• Add Azure Identity client library to your project
• Access Azure service with a system-assigned identity
• Access Azure service with a user-assigned identity

The linked examples use DefaultAzureCredential. It's useful for the majority of the scenarios because the same pattern works in Azure (with managed identities) and on your local machine (without managed identities).

For more code examples of the Azure Identity client library for JavaScript, see Azure Identity examples.

For Python apps and functions, the simplest way to work with a managed identity is through the Azure Identity client library for Python. For detailed guidance, see Tutorial: Connect to Azure databases from App Service without secrets using a managed identity.

See the respective documentation headings of the client library for information:

• Add Azure Identity client library to your project
• Access Azure service with a system-assigned identity
• Access Azure service with a user-assigned identity

The linked examples use DefaultAzureCredential. It's useful for the majority of the scenarios because the same pattern works in Azure (with managed identities) and on your local machine (without managed identities).

For Java apps and functions, the simplest way to work with a managed identity is through the Azure Identity client library for Java. For detailed guidance, see Tutorial: Connect to Azure databases from App Service without secrets using a managed identity.

See the respective documentation headings of the client library for information:

• Add Azure Identity client library to your project
• Access Azure service with a system-assigned identity
• Access Azure service with a user-assigned identity

The linked examples use DefaultAzureCredential. It's useful for the majority of the scenarios because the same pattern works in Azure (with managed identities) and on your local machine (without managed identities).

For more code examples of the Azure Identity client library for Java, see Azure Identity Examples.

Use the following script to retrieve a token from the local endpoint by specifying a resource URI of an Azure service:

$resourceURI = "https://<AAD-resource-URI-for-resource-to-obtain-token>"
$tokenAuthURI = $env:IDENTITY_ENDPOINT + "?resource=$resourceURI&api-version=2019-08-01"
$tokenResponse = Invoke-RestMethod -Method Get -Headers @{"X-IDENTITY-HEADER"="$env:IDENTITY_HEADER"} -Uri $tokenAuthURI
$accessToken = $tokenResponse.access_token

1. In the left navigation of your app's page, scroll down to the Settings group.

2. Select Identity. Then follow the steps based on the identity type:

   • System-assigned identity: Within the System assigned tab, switch Status to Off. Click Save.
   • User-assigned identity: Select the User assigned tab, select the checkbox for the identity, and select Remove. Select Yes to confirm.

To remove the system-assigned identity:

az webapp identity remove --name <app-name> --resource-group <group-name>

To remove one or more user-assigned identities:

az webapp identity remove --name <app-name> --resource-group <group-name> --identities <identity-id1> <identity-id2> ...

You can also remove the system assigned identity by specifying [system] in --identities.

For App Service

Run the Set-AzWebApp -AssignIdentity command to remove a system-assigned identity for App Service:

Set-AzWebApp -AssignIdentity $false -Name <app-name> -ResourceGroupName <group-name> 

For Functions

To remove all identities in Azure PowerShell (Azure Functions only):

# Update an existing function app to have IdentityType "None".
Update-AzFunctionApp -Name $functionAppName -ResourceGroupName $resourceGroupName -IdentityType None

To remove all identities in an ARM template:

"identity": {
    "type": "None"
}