Control: Azure > App Service > Web App > Managed Identity

Define the Managed Identity settings required for Azure > App Service > Web App.

A managed identity provides an automatically managed identity in Microsoft Entra ID (Azure Active Directory) that applications can use to obtain tokens without managing any credentials.

With the Enabled policy values this control checks that the Web App uses at least one managed identity of any kind — system-assigned, user-assigned, or both. When enforcing, a system-assigned identity is assigned only if the Web App has no managed identity.

With the Per Managed Identity > User Assigned Identity policy values this control instead requires the Web App's user-assigned identities to exactly match the Managed Identity > User Assigned Identity policy; a system-assigned identity is neither required nor removed. When enforcing, missing identities are assigned and identities not in the list are removed.

The System Assigned and Per Managed Identity > User Assigned Identity policy values additionally require a system-assigned identity. When enforcing, the system-assigned identity is enabled alongside the exact user-assigned identity list.