Block workload identity federation on managed identities using a policy

This article describes how to block the creation of federated identity credentials on user-assigned managed identities by using Azure Policy. By blocking the creation of federated identity credentials, you can block everyone from using workload identity federation to access Microsoft Entra protected resources. Azure Policy helps enforce certain business rules on your Azure resources and assess compliance of those resources.

The Not allowed resource types built-in policy can be used to block the creation of federated identity credentials on user-assigned managed identities.

Create a policy assignment

Tip

Steps in this article might vary slightly based on the portal you start from.

To create a policy assignment for the Not allowed resource types that blocks the creation of federated identity credentials in a subscription or resource group:

1. Sign in to the Azure portal.
2. Navigate to Policy in the Azure portal.
3. Go to the Definitions pane.
4. In the Search box, search for "Not allowed resource types" and select the Not allowed resource types policy in the list of returned items.
5. After selecting the policy, you can now see the Definition tab.
6. Click the Assign button to create an Assignment.
7. In the Basics tab, fill out Scope by setting the Subscription and optionally set the Resource Group.
8. In the Parameters tab, select userAssignedIdentities/federatedIdentityCredentials from the Not allowed resource types list. Select Review and create.
9. Apply the Assignment by selecting Create.
10. View your assignment in the Assignments tab next to Definition.

Next steps

Learn how to manage a federated identity credential on a user-assigned managed identity in Microsoft Entra ID.