Question

Your team is standardizing Azure Machine Learning workspace deployments through Bicep templates checked into a Git repository. Security policy requires that each workspace use a pre-created user-assigned managed identity (rather than a system-assigned identity) so that the same identity can be granted permissions on shared storage and Key Vault resources before the workspace exists. In the Microsoft.MachineLearningServices/workspaces Bicep resource, how should you configure the identity to meet this requirement?

Accepted Answer

Set the identity type to 'UserAssigned' and reference the identity's resource ID in the userAssignedIdentities map, then set primaryUserAssignedIdentity to that same resource ID.

Answer

Set the identity type to 'SystemAssigned' and grant the resulting principal access after deployment.

Answer

Omit the identity block entirely and assign the managed identity through the workspace's associated compute cluster.

Answer

Set the identity type to 'SystemAssigned, UserAssigned' and leave the userAssignedIdentities map empty so Azure generates one automatically.