Azure API Managment custom domain names with user assigned identity

Question

Steps (Azure portal):

1. Create Azure APIM (internal vnet, no system assigned managed identity!)
2. Create own Managed identity (user managed identity) - UAI
3. Create KeyVault
4. UAI: Create Role Assignment for UIA and KeyVault with Reader role and Scope KeyVault
5. KeyVault: Create KeyVault Access Policy for UAI with Get, List for Secrets and Certs
6. APIM: Assign UAI to APIM instance (no SystemAssigned Identity!)
7. KeyVault: Upload a cert to KeyVault for custom domain name
8. APIM: Try to create custom domain name in APIM, select Cert from KeyVault and then click add

Issue:
Portal asks me to grant Get/List to APIM instance. Why ? UAI should have that already!
If I click yes on the dialog that asks if I want to grant that policy an error occurs.

SystemAssigned Identity works by the way.

Did I miss something here ?

Answer 1

@Florian Eberl While using user-assigned managed idetities for TLS/SSL certs is supported, looks like this isn't supported in the portal but is possible to setup using ARM Templates or the ARM REST API.