Configure Managed identities for Azure resources on an Azure VM using REST API calls
Managed identities for Azure resources is a feature of Microsoft Entra ID. Each of the Azure services that support managed identities for Azure resources are subject to their own timeline. Make sure you review the availability status of managed identities for your resource and known issues before you begin.
Managed identities for Azure resources provide Azure services with an automatically managed system identity in Microsoft Entra ID. You can use this identity to authenticate to any service that supports Microsoft Entra authentication, without having credentials in your code.
In this article, using CURL to make calls to the Azure Resource Manager REST endpoint, you learn how to perform the following managed identities for Azure resources operations on an Azure VM:
- Enable and disable the system-assigned managed identity on an Azure VM
- Add and remove a user-assigned managed identity on an Azure VM
If you don't already have an Azure account, sign up for a free account before continuing.
Prerequisites
- If you're unfamiliar with managed identities for Azure resources, see What are managed identities for Azure resources?. To learn about system-assigned and user-assigned managed identity types, see Managed identity types.
Use the Bash environment in Azure Cloud Shell. For more information, see Quickstart for Bash in Azure Cloud Shell.
If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.
If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.
When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.
Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.
System-assigned managed identity
In this section, you learn how to enable and disable system-assigned managed identity on an Azure VM using CURL to make calls to the Azure Resource Manager REST endpoint.
Enable system-assigned managed identity during creation of an Azure VM
To create an Azure VM with the system-assigned managed identity enabled, your account needs the Virtual Machine Contributor role assignment. No other Microsoft Entra directory role assignments are required.
Create a resource group for containment and deployment of your VM and its related resources, using az group create. You can skip this step if you already have resource group you would like to use instead:
az group create --name myResourceGroup --location westusCreate a network interface for your VM:
az network nic create -g myResourceGroup --vnet-name myVnet --subnet mySubnet -n myNicRetrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity.
az account get-access-tokenUsing Azure Cloud Shell, create a VM using CURL to call the Azure Resource Manager REST endpoint. The following example creates a VM named myVM with a system-assigned managed identity, as identified in the request body by the value
"identity":{"type":"SystemAssigned"}. Replace<ACCESS TOKEN>with the value you received in the previous step when you requested a Bearer access token and the<SUBSCRIPTION ID>value as appropriate for your environment.curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PUT -d '{"location":"westus","name":"myVM","identity":{"type":"SystemAssigned"},"properties":{"hardwareProfile":{"vmSize":"Standard_D2_v2"},"storageProfile":{"imageReference":{"sku":"2016-Datacenter","publisher":"MicrosoftWindowsServer","version":"latest","offer":"WindowsServer"},"osDisk":{"caching":"ReadWrite","managedDisk":{"storageAccountType":"StandardSSD_LRS"},"name":"myVM3osdisk","createOption":"FromImage"},"dataDisks":[{"diskSizeGB":1023,"createOption":"Empty","lun":0},{"diskSizeGB":1023,"createOption":"Empty","lun":1}]},"osProfile":{"adminUsername":"azureuser","computerName":"myVM","adminPassword":"<SECURE PASSWORD STRING>"},"networkProfile":{"networkInterfaces":[{"id":"/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myNic","properties":{"primary":true}}]}}}' -H "Content-Type: application/json" -H "Authorization: Bearer <ACCESS TOKEN>"PUT https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "location":"westus", "name":"myVM", "identity":{ "type":"SystemAssigned" }, "properties":{ "hardwareProfile":{ "vmSize":"Standard_D2_v2" }, "storageProfile":{ "imageReference":{ "sku":"2016-Datacenter", "publisher":"MicrosoftWindowsServer", "version":"latest", "offer":"WindowsServer" }, "osDisk":{ "caching":"ReadWrite", "managedDisk":{ "storageAccountType":"StandardSSD_LRS" }, "name":"myVM3osdisk", "createOption":"FromImage" }, "dataDisks":[ { "diskSizeGB":1023, "createOption":"Empty", "lun":0 }, { "diskSizeGB":1023, "createOption":"Empty", "lun":1 } ] }, "osProfile":{ "adminUsername":"azureuser", "computerName":"myVM", "adminPassword":"myPassword12" }, "networkProfile":{ "networkInterfaces":[ { "id":"/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myNic", "properties":{ "primary":true } } ] } } }
Enable system-assigned identity on an existing Azure VM
To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the Virtual Machine Contributor role assignment. No other Microsoft Entra directory role assignments are required.
Retrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity.
az account get-access-tokenUse the following CURL command to call the Azure Resource Manager REST endpoint to enable system-assigned managed identity on your VM as identified in the request body by the value
{"identity":{"type":"SystemAssigned"}for a VM named myVM. Replace<ACCESS TOKEN>with the value you received in the previous step when you requested a Bearer access token and the<SUBSCRIPTION ID>value as appropriate for your environment.Important
To ensure you don't delete any existing user-assigned managed identities that are assigned to the VM, you need to list the user-assigned managed identities by using this CURL command:
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP>/providers/Microsoft.Compute/virtualMachines/<VM NAME>?api-version=2018-06-01' -H "Authorization: Bearer <ACCESS TOKEN>". If you have any user-assigned managed identities assigned to the VM as identified in theidentityvalue in the response, skip to step 3 that shows you how to retain user-assigned managed identities while enabling system-assigned managed identity on your VM.curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PATCH -d '{"identity":{"type":"SystemAssigned"}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"SystemAssigned" } }To enable system-assigned managed identity on a VM with existing user-assigned managed identities, you need to add
SystemAssignedto thetypevalue.For example, if your VM has the user-assigned managed identities
ID1andID2assigned to it, and you would like to add system-assigned managed identity to the VM, use the following CURL call. Replace<ACCESS TOKEN>and<SUBSCRIPTION ID>with values appropriate to your environment.API version
2018-06-01stores user-assigned managed identities in theuserAssignedIdentitiesvalue in a dictionary format as opposed to theidentityIdsvalue in an array format used in API version2017-12-01.API VERSION 2018-06-01
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PATCH -d '{"identity":{"type":"SystemAssigned, UserAssigned", "userAssignedIdentities":{"/subscriptions/<<SUBSCRIPTION ID>>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1":{},"/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2":{}}}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"SystemAssigned, UserAssigned", "userAssignedIdentities":{ "/subscriptions/<<SUBSCRIPTION ID>>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1":{ }, "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2":{ } } } }API VERSION 2017-12-01
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01' -X PATCH -d '{"identity":{"type":"SystemAssigned, UserAssigned", "identityIds":["/subscriptions/<<SUBSCRIPTION ID>>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1","/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2"]}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"SystemAssigned, UserAssigned", "identityIds":[ "/subscriptions/<<SUBSCRIPTION ID>>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1", "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2" ] } }
Disable system-assigned managed identity from an Azure VM
To disable system-assigned managed identity on a VM, your account needs the Virtual Machine Contributor role assignment. No other Microsoft Entra directory role assignments are required.
Retrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity.
az account get-access-tokenUpdate the VM using CURL to call the Azure Resource Manager REST endpoint to disable system-assigned managed identity. The following example disables system-assigned managed identity as identified in the request body by the value
{"identity":{"type":"None"}}from a VM named myVM. Replace<ACCESS TOKEN>with the value you received in the previous step when you requested a Bearer access token and the<SUBSCRIPTION ID>value as appropriate for your environment.Important
To ensure you don't delete any existing user-assigned managed identities that are assigned to the VM, you need to list the user-assigned managed identities by using this CURL command:
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP>/providers/Microsoft.Compute/virtualMachines/<VM NAME>?api-version=2018-06-01' -H "Authorization: Bearer <ACCESS TOKEN>". If you have any user-assigned managed identities assigned to the VM as identified in theidentityvalue in the response, skip to step 3 that shows you how to retain user-assigned managed identities while disabling system-assigned managed identity on your VM.curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PATCH -d '{"identity":{"type":"None"}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"None" } }To remove system-assigned managed identity from a virtual machine that has user-assigned managed identities, remove
SystemAssignedfrom the{"identity":{"type:" "}}value while keeping theUserAssignedvalue and theuserAssignedIdentitiesdictionary values if you are using API version 2018-06-01. If you are using API version 2017-12-01 or earlier, keep theidentityIdsarray.
User-assigned managed identity
In this section, you learn how to add and remove user-assigned managed identity on an Azure VM using CURL to make calls to the Azure Resource Manager REST endpoint.
Assign a user-assigned managed identity during the creation of an Azure VM
To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No other Microsoft Entra directory role assignments are required.
Retrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity.
az account get-access-tokenCreate a network interface for your VM:
az network nic create -g myResourceGroup --vnet-name myVnet --subnet mySubnet -n myNicRetrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity.
az account get-access-tokenCreate a user-assigned managed identity using the instructions found here: Create a user-assigned managed identity.
Create a VM using CURL to call the Azure Resource Manager REST endpoint. The following example creates a VM named myVM in the resource group myResourceGroup with a user-assigned managed identity
ID1, as identified in the request body by the value"identity":{"type":"UserAssigned"}. Replace<ACCESS TOKEN>with the value you received in the previous step when you requested a Bearer access token and the<SUBSCRIPTION ID>value as appropriate for your environment.API VERSION 2018-06-01
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PUT -d '{"location":"westus","name":"myVM","identity":{"type":"UserAssigned","identityIds":["/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1"]},"properties":{"hardwareProfile":{"vmSize":"Standard_D2_v2"},"storageProfile":{"imageReference":{"sku":"2016-Datacenter","publisher":"MicrosoftWindowsServer","version":"latest","offer":"WindowsServer"},"osDisk":{"caching":"ReadWrite","managedDisk":{"storageAccountType":"StandardSSD_LRS"},"name":"myVM3osdisk","createOption":"FromImage"},"dataDisks":[{"diskSizeGB":1023,"createOption":"Empty","lun":0},{"diskSizeGB":1023,"createOption":"Empty","lun":1}]},"osProfile":{"adminUsername":"azureuser","computerName":"myVM","adminPassword":"myPassword12"},"networkProfile":{"networkInterfaces":[{"id":"/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myNic","properties":{"primary":true}}]}}}' -H "Content-Type: application/json" -H "Authorization: Bearer <ACCESS TOKEN>"PUT https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "location":"westus", "name":"myVM", "identity":{ "type":"UserAssigned", "identityIds":[ "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1" ] }, "properties":{ "hardwareProfile":{ "vmSize":"Standard_D2_v2" }, "storageProfile":{ "imageReference":{ "sku":"2016-Datacenter", "publisher":"MicrosoftWindowsServer", "version":"latest", "offer":"WindowsServer" }, "osDisk":{ "caching":"ReadWrite", "managedDisk":{ "storageAccountType":"StandardSSD_LRS" }, "name":"myVM3osdisk", "createOption":"FromImage" }, "dataDisks":[ { "diskSizeGB":1023, "createOption":"Empty", "lun":0 }, { "diskSizeGB":1023, "createOption":"Empty", "lun":1 } ] }, "osProfile":{ "adminUsername":"azureuser", "computerName":"myVM", "adminPassword":"myPassword12" }, "networkProfile":{ "networkInterfaces":[ { "id":"/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myNic", "properties":{ "primary":true } } ] } } }API VERSION 2017-12-01
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01' -X PUT -d '{"location":"westus","name":"myVM","identity":{"type":"UserAssigned","identityIds":["/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1"]},"properties":{"hardwareProfile":{"vmSize":"Standard_D2_v2"},"storageProfile":{"imageReference":{"sku":"2016-Datacenter","publisher":"MicrosoftWindowsServer","version":"latest","offer":"WindowsServer"},"osDisk":{"caching":"ReadWrite","managedDisk":{"storageAccountType":"StandardSSD_LRS"},"name":"myVM3osdisk","createOption":"FromImage"},"dataDisks":[{"diskSizeGB":1023,"createOption":"Empty","lun":0},{"diskSizeGB":1023,"createOption":"Empty","lun":1}]},"osProfile":{"adminUsername":"azureuser","computerName":"myVM","adminPassword":"myPassword12"},"networkProfile":{"networkInterfaces":[{"id":"/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myNic","properties":{"primary":true}}]}}}' -H "Content-Type: application/json" -H "Authorization: Bearer <ACCESS TOKEN>"PUT https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "location":"westus", "name":"myVM", "identity":{ "type":"UserAssigned", "identityIds":[ "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1" ] }, "properties":{ "hardwareProfile":{ "vmSize":"Standard_D2_v2" }, "storageProfile":{ "imageReference":{ "sku":"2016-Datacenter", "publisher":"MicrosoftWindowsServer", "version":"latest", "offer":"WindowsServer" }, "osDisk":{ "caching":"ReadWrite", "managedDisk":{ "storageAccountType":"StandardSSD_LRS" }, "name":"myVM3osdisk", "createOption":"FromImage" }, "dataDisks":[ { "diskSizeGB":1023, "createOption":"Empty", "lun":0 }, { "diskSizeGB":1023, "createOption":"Empty", "lun":1 } ] }, "osProfile":{ "adminUsername":"azureuser", "computerName":"myVM", "adminPassword":"myPassword12" }, "networkProfile":{ "networkInterfaces":[ { "id":"/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/myNic", "properties":{ "primary":true } } ] } } }
Assign a user-assigned managed identity to an existing Azure VM
To assign a user-assigned identity to a VM, your account needs the Virtual Machine Contributor and Managed Identity Operator role assignments. No other Microsoft Entra directory role assignments are required.
Retrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity.
az account get-access-tokenCreate a user-assigned managed identity using the instructions found here, Create a user-assigned managed identity.
To ensure you don't delete existing user or system-assigned managed identities that are assigned to the VM, you need to list the identity types assigned to the VM by using the following CURL command. If you have managed identities assigned to the virtual machine scale set, they are listed under in the
identityvalue.curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP>/providers/Microsoft.Compute/virtualMachines/<VM NAME>?api-version=2018-06-01' -H "Authorization: Bearer <ACCESS TOKEN>"GET https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP>/providers/Microsoft.Compute/virtualMachines/<VM NAME>?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Authorization Required. Set to a valid Beareraccess token.If you have any user or system-assigned managed identities assigned to the VM as identified in the
identityvalue in the response, skip to step 5 that shows you how to retain the system-assigned managed identity while adding a user-assigned managed identity on your VM.If you don't have any user-assigned managed identities assigned to your VM, use the following CURL command to call the Azure Resource Manager REST endpoint to assign the first user-assigned managed identity to the VM.
The following example assigns a user-assigned managed identity,
ID1to a VM named myVM in the resource group myResourceGroup. Replace<ACCESS TOKEN>with the value you received in the previous step when you requested a Bearer access token and the<SUBSCRIPTION ID>value as appropriate for your environment.API VERSION 2018-06-01
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PATCH -d '{"identity":{"type":"UserAssigned", "userAssignedIdentities":{"/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1":{}}}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"UserAssigned", "userAssignedIdentities":{ "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1":{ } } } }API VERSION 2017-12-01
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01' -X PATCH -d '{"identity":{"type":"userAssigned", "identityIds":["/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1"]}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"userAssigned", "identityIds":[ "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1" ] } }If you have an existing user-assigned or system-assigned managed identity assigned to your VM:
API VERSION 2018-06-01
Add the user-assigned managed identity to the
userAssignedIdentitiesdictionary value.For example, if you have system-assigned managed identity and the user-assigned managed identity
ID1currently assigned to your VM and would like to add the user-assigned managed identityID2to it:curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PATCH -d '{"identity":{"type":"SystemAssigned, UserAssigned", "userAssignedIdentities":{"/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1":{},"/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2":{}}}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"SystemAssigned, UserAssigned", "userAssignedIdentities":{ "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1":{ }, "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2":{ } } } }API VERSION 2017-12-01
Retain the user-assigned managed identities you would like to keep in the
identityIdsarray value while adding the new user-assigned managed identity.For example, if you have system-assigned managed identity and the user-assigned managed identity
ID1currently assigned to your VM and would like to add the user-assigned managed identityID2to it:curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01' -X PATCH -d '{"identity":{"type":"SystemAssigned,UserAssigned", "identityIds":["/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1","/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2"]}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"SystemAssigned,UserAssigned", "identityIds":[ "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1", "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2" ] } }
Remove a user-assigned managed identity from an Azure VM
To remove a user-assigned identity to a VM, your account needs the Virtual Machine Contributor role assignment.
Retrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity.
az account get-access-tokenTo ensure you don't delete any existing user-assigned managed identities that you would like to keep assigned to the VM or remove the system-assigned managed identity, you need to list the managed identities by using the following CURL command:
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP>/providers/Microsoft.Compute/virtualMachines/<VM NAME>?api-version=2018-06-01' -H "Authorization: Bearer <ACCESS TOKEN>"GET https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP>/providers/Microsoft.Compute/virtualMachines/<VM NAME>?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.If you have managed identities assigned to the VM, they are listed in the response in the
identityvalue.For example, if you have user-assigned managed identities
ID1andID2assigned to your VM, and you only want to keepID1assigned and retain the system-assigned identity:API VERSION 2018-06-01
Add
nullto the user-assigned managed identity you would like to remove:curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PATCH -d '{"identity":{"type":"SystemAssigned, UserAssigned", "userAssignedIdentities":{"/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2":null}}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"SystemAssigned, UserAssigned", "userAssignedIdentities":{ "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID2":null } } }API VERSION 2017-12-01
Retain only the user-assigned managed identity(s) you would like to keep in the
identityIdsarray:curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01' -X PATCH -d '{"identity":{"type":"SystemAssigned, UserAssigned", "identityIds":["/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1"]}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2017-12-01 HTTP/1.1Request headers
Request header Description Content-Type Required. Set to application/json.Authorization Required. Set to a valid Beareraccess token.Request body
{ "identity":{ "type":"SystemAssigned, UserAssigned", "identityIds":[ "/subscriptions/<SUBSCRIPTION ID>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ID1" ] } }
If your VM has both system-assigned and user-assigned managed identities, you can remove all the user-assigned managed identities by switching to use only system-assigned managed identity using the following command:
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PATCH -d '{"identity":{"type":"SystemAssigned"}}' -H "Content-Type: application/json" -H "Authorization:Bearer <ACCESS TOKEN>"
PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1
Request headers
| Request header | Description |
|---|---|
| Content-Type | Required. Set to application/json. |
| Authorization | Required. Set to a valid Bearer access token. |
Request body
{
"identity":{
"type":"SystemAssigned"
}
}
If your VM has only user-assigned managed identities and you would like to remove them all, use the following command:
curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01' -X PATCH -d '{"identity":{"type":"None"}}' -H "Content-Type: application/json" -H Authorization:"Bearer <ACCESS TOKEN>"
PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM?api-version=2018-06-01 HTTP/1.1
Request headers
| Request header | Description |
|---|---|
| Content-Type | Required. Set to application/json. |
| Authorization | Required. Set to a valid Bearer access token. |
Request body
{
"identity":{
"type":"None"
}
}
Next steps
For information on how to create, list, or delete user-assigned managed identities using REST see:
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for