Managed identity
Assign a system-assigned or user-assigned managed identity to an app, and its code calls Azure services without stored credentials.
Identity types
| Identity | Ownership |
|---|---|
| System-assigned | Created for one app and tied to it |
| User-assigned | An Azure resource you create separately; it can be attached to multiple apps |
An app can have either type or both.
Assign an identity
Open the app's Identity page in the Portal, turn on the system-assigned identity or add user-assigned identities, then select Save and deploy.
Alternatively, set the identity block through ARM.
Builder saves the assignment and redeploys the app's latest build, so the running app has the identity once that deployment succeeds.
The Identity page shows the IDs you need for role assignments and AZURE_CLIENT_ID.
Grant access
Assign an Azure role to the identity on the destination, such as Cosmos DB Built-in Data Reader on a database or Storage Blob Data Reader on a storage account.
Use it in code
Azure SDK credentials such as DefaultAzureCredential use the system-assigned identity when AZURE_CLIENT_ID is unset.
To use a user-assigned identity, set the AZURE_CLIENT_ID app variable to its client ID.
While the variable is unset, select Set as AZURE_CLIENT_ID next to the identity on the Identity page; it is applied with the same Save and deploy.
Builder sets AZURE_CLIENT_ID only when you select it; change or remove it on the Variables page.
Removal and deletion
Deleting an app deletes its system-assigned identity but not its user-assigned identities.
Related guides
Connecting to services covers application-owned credentials, endpoints, and permissions.