Policy: Azure > App Service > Web App > Managed Identity

Define the Managed Identity setting required for Azure > App Service > Web App.

A managed identity provides an automatically managed identity in Microsoft Entra ID (Azure Active Directory) that applications can use to obtain tokens without managing any credentials.

The Enabled values require the Web App to use at least one managed identity of any kind — system-assigned, user-assigned, or both. When enforcing, a system-assigned identity is assigned only if the Web App has no managed identity. The Disabled values require the Web App to use no managed identity.

The Per Managed Identity > User Assigned Identity values require the Web App's user-assigned identities to exactly match the Azure > App Service > Web App > Managed Identity > User Assigned Identity policy; a system-assigned identity is neither required nor removed. When enforcing, missing identities are assigned and identities not in the list are removed.

The System Assigned and Per Managed Identity > User Assigned Identity values additionally require a system-assigned identity, so a single setting can require both identity kinds. When enforcing, the system-assigned identity is enabled alongside the exact user-assigned identity list.