Microsoft Entra Workload ID

Configure assignment restriction for user-assigned managed identities (preview)

In brief

Learn how to configure assignment restriction for a user-assigned managed identity in the Azure portal to scope it to specific resource providers.

Documentation change

Configure assignment restriction for user-assigned managed identities

Configure assignment restriction for user-assigned managed identities (preview)

This article describes how to configure assignment restrictions (also referred to as resource restrictions) for a user-assigned managed identity by using the Azure portal.

This article describes how to configure assignment restrictions (also referred to as resource restrictions) for a user-assigned managed identity by using the Azure portal. This is a feature in preview.

Assignment restrictions let you explicitly define the resource providers or resource types that a managed identity can be assigned to. Enforcing assignment restrictions keeps managed identities within their intended scope, which strengthens security and operational boundaries. By restricting where a managed identity can be assigned, you limit identity reuse and reduce blast radius.

Supported resource providers and resource types in the Azure portal

The Select Resource Types pane in the Azure portal does not display all resource providers and resource types that support managed identities. If the resource you want to configure is not listed, use the Azure CLI to create or update the identity assignment. Refer to the Azure CLI examples below for resources that are not currently available in the Select Resource Types list.

Create an identity with resource assignment restrictions

az identity create \
  --name MyIdentity \
  --resource-group MyResourceGroup \
  --resource-restriction '{"providers": ["Microsoft.Compute", "Microsoft.Storage/Accounts"]}'

Update an identity to restrict assignment to specific resources

az identity update \
  --name MyIdentity \
  --resource-group MyResourceGroup \
  --resource-restriction '{"providers": ["Microsoft.Compute", "Microsoft.Storage/Accounts"]}'

List the associated resources for an identity

az identity list-resources \
  --name MyIdentity \
  --resource-group MyResourceGroup

Create an unrestricted identity

az identity create \
--name MyIdentity \
--resource-group MyResourceGroup \
--resource-restriction '{"providers": []}'

Remove all resource provider restrictions from an identity

az identity update \
--name MyIdentity \
--resource-group MyResourceGroup \
--resource-restriction '{"providers": []}'