This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 21%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
We are trying to migrate away from using keys to access our blob storage for an Azure hosted web application that is using Cloud Services (Extended Support). We want to use the Microsoft recommended approach of Role Based access via Entra Id.
We have updated our application to use the Azure.Storage.Blobs dll with DefaultAzureCredential.
Accessing our document storage from visual studio using our developer credentials is working great.
I am not understanding how to enable a managed identity for the application running on Cloud Service (Extended Support)? Access is working if I run the application as an App Service, but we wanted to be able to keep the application as a Cloud Service (extended support).
How do I enable a managed identity for Cloud Service (extended support)?
Hello christian
Any update on the issue?
Just checking in to see if you got a chance to see previous response.
If the suggested response helped you resolve your issue, please 'Accept as answer', so that it can help others in the community looking for help on similar topics.
Hi Vipullag -
Thanks for your reply! It was very helpful to understand Managed Identity is not supported by Cloud Service (Extended Support).
I wasn't familiar with SubjectName+Issuer authentication, nor did I find any good examples online. My code is .NET Framework 4.8 if you happen to know of any documentation?
Looking at what I could find in the Microsoft documentation, I was thinking that based on the order of authentication of the DefaultAuzreCredentials that I might try setting up the required environment variables in my Cloud Service (Extended Support) server.
I am also going to speak with my business owners to perhaps switch to an App Service deployment.
Based on your answer I know a system assigned Managed Identity is not possible from Cloud Service (Extended Support), but I was also considering, perhaps attempting a User-assigned managed identities.
Hello christian
Apologies for delayed response on this.
Please check this documentation: https://video2.skills-academy.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory
You can use MSAL library for SN+I and obtaining the token and then storage account access with the "Storage Blob Data Contributor" role - of course this role only works for blobs. There are analogous roles for queue and table access.
And here are some information on SN+I with Entra: https://video2.skills-academy.com/en-us/entra/identity/authentication/concept-certificate-based-authentication
Hope this helps.
If the suggested response helped you resolve your issue, please 'Accept as answer', so that it can help others in the community looking for help on similar topics.
Hello christian
Welcome to Microsoft Q&A Platform, thanks for posting your query here.
I just checked with internal team on this ask and Cloud Service Extended Support does not support managed identity, you could use SubjectName+Issuer authentication instead.
Hope this helps.