Question

Contoso runs an Azure Function App in Tenant A that must read secrets from an Azure Key Vault located in a subscription owned by Tenant B (a recently acquired subsidiary). You want the Function App to authenticate to Key Vault without storing any credentials. You enable a system-assigned managed identity on the Function App and attempt to grant it access to the Key Vault in Tenant B. The access assignment fails. What is the correct explanation and recommended approach?

Accepted Answer

Managed identities cannot be used to authenticate across Microsoft Entra tenant boundaries; use a multi-tenant app registration with a service principal and certificate credential instead.

Answer

System-assigned managed identities never support Key Vault; switch to a user-assigned managed identity, which can be granted access in any tenant.

Answer

You must enable the Key Vault firewall exception for trusted Microsoft services, after which the managed identity from Tenant A can be assigned directly.

Answer

Assign the Contributor role on the Key Vault to the managed identity at the subscription scope in Tenant B to allow cross-tenant token issuance.