Managed Identity Setup

Configure Managed Identity with RBAC for credential-free Azure service access.

When to Use

• Connecting an app to Azure OpenAI without API keys
• Setting up service-to-service auth with least-privilege
• Replacing connection strings with identity-based access
• Configuring user-assigned identity for multi-service scenarios

System-Assigned vs User-Assigned

Enable System-Assigned MI

resource functionApp 'Microsoft.Web/sites@2023-12-01' = {
  name: appName
  location: location
  identity: { type: 'SystemAssigned' }
  // ...
}

RBAC Assignment

var roles = {
  openAIUser: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
  blobReader: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
  kvSecretsUser: '4633458b-17de-408a-b874-0445c86b69e6'
}

resource openAIRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(openAI.id, app.id, roles.openAIUser)
  scope: openAI
  properties: {
    principalId: functionApp.identity.principalId
    roleDefinitionId: subscriptionResourceId(
      'Microsoft.Authorization/roleDefinitions', roles.openAIUser)
    principalType: 'ServicePrincipal'
  }
}

Python SDK with MI

from azure.identity import DefaultAzureCredential, get_bearer_token_provider
from openai import AzureOpenAI

token_provider = get_bearer_token_provider(
    DefaultAzureCredential(), "https://cognitiveservices.azure.com/.default"
)
client = AzureOpenAI(
    azure_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
    azure_ad_token_provider=token_provider,
    api_version="2024-10-21",
)

.NET with MI

var client = new AzureOpenAIClient(
    new Uri(endpoint), new DefaultAzureCredential());

Common Role Assignments

Troubleshooting