Guide

Identity

Managed identity is the Azure trust anchor for a sandbox group. Attach a system-assigned or user-assigned identity, then grant it Azure roles for the resources your sandboxes call.

Create a group with a system-assigned identity

A system-assigned identity belongs to one sandbox group. Azure deletes the identity when you delete the group.

1. Open sandboxes.azure.com/sandbox-groups and select Create.
2. Choose a subscription, resource group, name, and region.
3. Open Identity.
4. Turn System assigned on.
5. Select Create. After provisioning, copy the Principal ID from the identity card.

CLI support

Setting identity at group creation time is currently supported in the portal flow and SDK only. CLI support for inline identity assignment at creation is coming soon. For now, create the group first with the CLI, then use the next section to attach an identity after creation.

from azure.identity import DefaultAzureCredential
from azure.containerapps.sandbox import SandboxGroupManagementClient

credential = DefaultAzureCredential()
mgmt = SandboxGroupManagementClient(
    credential,
    subscription_id=AZURE_SUBSCRIPTION_ID,
    resource_group=ACA_RESOURCE_GROUP,
)

group = mgmt.begin_create_group(
    "mi-demo",
    ACA_SANDBOXGROUP_REGION,
    identity={"type": "SystemAssigned"},
).result()
print(group.identity.get("principalId"))

Add identity to an existing group

Use this flow when the group already exists and you want to add Azure access without recreating sandboxes.

1. Open the sandbox group.
2. Select Identity.
3. Turn System assigned on, or select Add under User assigned and choose an existing managed identity.
4. Select Save.
5. Wait for the identity details to appear before assigning roles.

Bash

aca sandboxgroup identity assign \
  --group mi-demo \
  --system-assigned

aca sandboxgroup identity assign \
  --group mi-demo \
  --user-assigned "$USER_ASSIGNED_IDENTITY_RESOURCE_ID"

PowerShell

aca sandboxgroup identity assign `
  --group mi-demo `
  --system-assigned

aca sandboxgroup identity assign `
  --group mi-demo `
  --user-assigned $env:USER_ASSIGNED_IDENTITY_RESOURCE_ID

SDK

mgmt.patch_group_identity(
    "mi-demo",
    {"type": "SystemAssigned"},
)

mgmt.patch_group_identity(
    "mi-demo",
    {
        "type": "UserAssigned",
        "userAssignedIdentities": {
            USER_ASSIGNED_IDENTITY_RESOURCE_ID: {},
        },
    },
)

Read identity details

Read identity details before you create role assignments. The principal ID can take a few seconds to appear after assignment.

1. Open the sandbox group and select Identity.
2. Review Type, Principal ID, and Tenant ID.
3. Copy the Principal ID for Azure role assignment.

Bash

aca sandboxgroup identity show --group mi-demo

PowerShell

aca sandboxgroup identity show --group mi-demo

SDK

group = mgmt.get_group("mi-demo")
identity = group.identity or {}
print(identity.get("type"))
print(identity.get("principalId"))
print(identity.get("tenantId"))

Remove identity

Removing a system-assigned identity deletes its service principal and role assignments. Removing a user-assigned identity detaches it from the group but does not delete the identity resource.

1. Open the sandbox group and select Identity.
2. Turn System assigned off, or remove the user-assigned identity row.
3. Select Save and confirm.

Bash

aca sandboxgroup identity remove --group mi-demo

PowerShell

aca sandboxgroup identity remove --group mi-demo

SDK

mgmt.patch_group_identity("mi-demo", {"type": "None"})
mgmt.delete_group("mi-demo")
mgmt.close()
credential.close()

Related

Sandbox groups

Create the group before you attach identity.

Learn more →

Secrets

Store app credentials when managed identity is not available.

Learn more →

Data-plane access

Grant SandboxGroup Data Owner before using group data APIs.

Learn more →