Edit

Configure assignment restriction for user-assigned managed identities (preview)

This article describes how to configure assignment restrictions (also referred to as resource restrictions) for a user-assigned managed identity by using the Azure portal. This is a feature in preview.

Assignment restrictions let you explicitly define the resource providers or resource types that a managed identity can be assigned to. Enforcing assignment restrictions keeps managed identities within their intended scope, which strengthens security and operational boundaries. By restricting where a managed identity can be assigned, you limit identity reuse and reduce blast radius.

Prerequisites

Before you begin, make sure you have the following:

Create assignment restrictions in the Azure portal

You configure assignment restrictions when you create a user-assigned managed identity. To create a user-assigned managed identity with assignment restrictions, follow these steps:

  1. Sign in to the Azure portal with at least the Managed Identity Contributor role.

  2. Go to Managed Identities. In the search box, enter Managed Identities. Under Services, select Managed Identities.

  3. Select + Create to add a new user-assigned managed identity and configure the basic settings:

    • Subscription: Select your subscription.
    • Resource group: Choose an existing resource group or create a new one.
    • Name: Enter a name for the managed identity.
    • Region: Select the region for deployment.
    • Isolation Scope: Select the isolation scope. We recommend setting this value to Regional for regional isolation. For more information, see Isolation scope for user-assigned managed identities.
    • Resource: Select Add resource. In the Select Resource Types panel that opens, search for and select the resource provider or resource type that the identity is restricted to.

    Note

    If Resource is left unconfigured, the value shows as None, which represents an empty array.

  4. Select Review + create to validate your configuration.

  5. Select Create to deploy the managed identity.

Update assignment restrictions in the Azure portal

You can update the isolation scope and assignment restrictions of an existing user-assigned managed identity at any time. To update assignment restrictions, follow these steps:

  1. Sign in to the Azure portal with at least the Managed Identity Contributor role.

  2. Go to Managed Identities, and then select the user-assigned managed identity that you want to update.

  3. Under Settings, select Properties.

  4. Update the assignment restrictions:

    • Isolation Scope: Select Regional or None.
    • Resource: Select the edit (pencil) icon. In the Select Resource Types panel that opens, add or remove the resource providers or resource types that the identity is restricted to.

  5. Select Save to apply your changes.

Note

If your update removes a resource provider from the assignment restrictions list, unassign the user-assigned managed identity from the source resource first, before you remove the resource provider from the list.

Supported resource providers and resource types in the Azure portal

Note

Selecting None for resource assignment restrictions leaves the identity unrestricted, allowing it to be assigned to resources from any resource provider that supports managed identities.

Configure resource assignment restrictions only when you want to limit identity assignment to specific resource providers. Be aware that the Select Resource Types list in the Azure portal may not include all supported resource providers and resource types.

The Select Resource Types pane in the Azure portal does not display all resource providers and resource types that support managed identities. If the resource you want to configure is not listed, use the Azure CLI to create or update the identity assignment. Refer to the Azure CLI examples below for resources that are not currently available in the Select Resource Types list.

Create an identity with resource assignment restrictions

az identity create \
  --name MyIdentity \
  --resource-group MyResourceGroup \
  --resource-restriction '{"providers": ["Microsoft.Compute", "Microsoft.Storage/Accounts"]}'

Update an identity to restrict assignment to specific resources

az identity update \
  --name MyIdentity \
  --resource-group MyResourceGroup \
  --resource-restriction '{"providers": ["Microsoft.Compute", "Microsoft.Storage/Accounts"]}'

List the associated resources for an identity

az identity list-resources \
  --name MyIdentity \
  --resource-group MyResourceGroup

Create an unrestricted identity

az identity create \
--name MyIdentity \
--resource-group MyResourceGroup \
--resource-restriction '{"providers": []}'

Remove all resource provider restrictions from an identity

az identity update \
--name MyIdentity \
--resource-group MyResourceGroup \
--resource-restriction '{"providers": []}'

Related content

  • Last updated on