What's new?

• The Azure > App Service > Web App > Managed Identity control (previously System Assigned Identity) now supports user-assigned managed identities alongside the existing system-assigned support. To require specific user-assigned identities, list their resource IDs in the new Azure > App Service > Web App > Managed Identity > User Assigned Identity policy and set the control's policy to Check: Per Managed Identity > User Assigned Identity or Enforce: Per Managed Identity > User Assigned Identity — when enforcing, Guardrails assigns the missing identities and removes any not on the list. To require a system-assigned identity as well, use the Check: System Assigned and Per Managed Identity > User Assigned Identity or Enforce: System Assigned and Per Managed Identity > User Assigned Identity value. Enforcing user-assigned identities requires the Guardrails identity to hold the Microsoft.ManagedIdentity/userAssignedIdentities/assign/action permission on the identities being assigned.

Control Types

Renamed

• Azure > App Service > Web App > System Assigned Identity to Azure > App Service > Web App > Managed Identity

Policy Types

Added

• Azure > App Service > Web App > Managed Identity > User Assigned Identity

Renamed

• Azure > App Service > Web App > System Assigned Identity to Azure > App Service > Web App > Managed Identity

Action Types

Renamed

• Azure > App Service > Web App > Set System Assigned Identity to Azure > App Service > Web App > Set Managed Identity