User Assigned Managed Identity¶

Creates a user-assigned managed identity, optionally with federated identity credentials for workload identity federation, and role assignments scoped to the identity itself.

Summary¶

User-assigned managed identity with federated credentials and identity-scoped role assignments.

Module Information¶

Property	Value
Owner	platform-team
Support	Support
Version	1.0.0

Resource Types¶

Resource Type
`Microsoft.Authorization/roleAssignments`
`Microsoft.ManagedIdentity/userAssignedIdentities`
`Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials`

Usage¶

module user_assigned_identity 'br:geitbicepmodweucr01.azurecr.io/bicep/modules/managed-identity/user-assigned-identity:1.0.0' = {
  name: 'user_assigned_identity'
  params: {
    // Required parameters
    par_identity_name: <string>
  }
}

Parameters¶

Name	Type	Description	Default
`par_federated_identity_credentials`	`array`	Optional. Federated identity credentials for workload identity federation. Defaults to none. Credentials are created one at a time because the service rejects parallel writes.	``
`par_identity_name`	`string`	Name of the user-assigned managed identity.	required
`par_location`	`string`	Azure region for the identity. Defaults to the resource group location.	`[resourceGroup().location]`
`par_role_assignments`	`array`	Optional. Role assignments applied to the identity itself. Managed DevOps Pools needs the DevOpsInfrastructure service principal to hold Managed Identity Operator (f1a07417-d97a-45cb-824c-7a7467783830) here when this identity is attached to a pool. Retrieve its object ID with: az ad sp list --display-name DevOpsInfrastructure --query "[].id" -o tsv.	``
`par_tags`	`object`	Resource tags applied to the identity.	``

Outputs¶

Name	Type	Description
`out_client_id`	`string`	Client ID of the identity, used by applications requesting tokens.
`out_identity_id`	`string`	Resource ID of the deployed user-assigned managed identity.
`out_identity_name`	`string`	Name of the deployed user-assigned managed identity.
`out_principal_id`	`string`	Object ID of the identity service principal, used as principalId in role assignments.

Versions¶

Pin an exact version. Ranges are not supported.

Version	Reference
`1.0.0` (latest)	`br/Euvic-Modules:managed-identity/user-assigned-identity:1.0.0`