Summary: Azure Marketplace VM image created by DevTest Labs did not get assigned the system-assigned managed identity upon creation Steps: Verify that DevTest Lab Configuration and policies | Identity (Preview) page is on (default setting anyway) Create VM within DevTest portal using base Free SQL Server License: SQL Server 2019 Developer on Windows Server 2022 Verify identities on the VM via CLI az vm identity show -n vm07 -g LAB0123456791000 Result: No identities returned Desired: I'd like the system-assigned managed identity to be there from the get go. That way I can use command such as AzCopy to get data from my blob (in the same subscription/resource group as the VM) without having to login with my personal credentials. Workaround: az login and go through webpage authentication using my personal credentials -> urgh Figure out which vm/scope to use Run az vm identity assign --role Reader --identities [system] -n vm07 -g LAB0123456791000--scope /subscriptions/123-234-3456-567 to assign the identity -> pain

Hello @Sameer Youssef , Welcome to Microsoft QnA. Are you seeing something like this on the Portal under Identity of your DevTest Lab?

Hi Sameer, Have you seen this preview feature for automatically assigning managed identities using Azure Policy? how-to-assign-managed-identity-via-azure-policy

How to automatically assign System-assigned managed identity to DevTest Lab Windows VM

Sameer Youssef 1

Summary: Azure Marketplace VM image created by DevTest Labs did not get assigned the system-assigned managed identity upon creation

Steps:

Verify that DevTest Lab Configuration and policies | Identity (Preview) page is on (default setting anyway)
Create VM within DevTest portal using base Free SQL Server License: SQL Server 2019 Developer on Windows Server 2022
Verify identities on the VM via CLI az vm identity show -n vm07 -g LAB0123456791000

Result:

No identities returned

Desired:

I'd like the system-assigned managed identity to be there from the get go. That way I can use command such as AzCopy to get data from my blob (in the same subscription/resource group as the VM) without having to login with my personal credentials.

Workaround:

az login and go through webpage authentication using my personal credentials -> urgh
Figure out which vm/scope to use
Run az vm identity assign --role Reader --identities [system] -n vm07 -g LAB0123456791000--scope /subscriptions/123-234-3456-567 to assign the identity -> pain

Sameer Youssef 1 Reputation point

2022-08-11T02:43:31.09+00:00

I'm also open to suggestions on better ways to do this - but this DevTest Lab should outlive me - I may leave the company and my credentials will be invalidated - but the VM should still be able to function...

2 answers

srbhatta-MSFT 8,546 Reputation points Microsoft Employee

2022-08-16T14:31:42.247+00:00

Hello @Sameer Youssef ,
Welcome to Microsoft QnA.
Are you seeing something like this on the Portal under Identity of your DevTest Lab?
Please sign in to rate this answer.

1 person found this answer helpful.
Sameer Youssef 1 Reputation point

2022-08-16T21:29:49.613+00:00

HI @srbhatta-MSFT

Yes - https://ibb.co/5K5RrSH

But the system identity is not automatically assigned to my VM - have to assign it myself to the VM after logging into AZ with my personal credentials.

srbhatta-MSFT 8,546 Reputation points Microsoft Employee

2022-08-17T07:36:37.873+00:00

@Sameer Youssef , oh is it? Let me give it a quick check, as far as I remember mine got assigned automatically, but let me verify once again and get back to you on this in sometime.

srbhatta-MSFT 8,546 Reputation points Microsoft Employee

2022-08-17T08:20:10.617+00:00

Hi @Sameer Youssef , I recreated a devtest lab in my test environment and the system managed identity gets assigned automatically. Could you please re-check if you have a lab environment of your own (non-prod) ? Let me know. Thanks

Sameer Youssef 1 Reputation point

2022-08-17T21:55:07.28+00:00

Thank you for looking into this @srbhatta-msft :) So these are my steps: - Log into portal.azure.com under tenant with offer Enterprise Agreement - Using an existing subscription create a DevTest Lab - and set it to use a new resource group - Create a VM within the lab - image Free SQL Server License: SQL Server 2019 Developer on Windows Server 2022 - Remote desktop connect into VM - Install Azure CLI with command `$ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri https://aka.ms/installazurecliwindows -OutFile .\AzureCLI.msi; Start-Process msiexec.exe -Wait -ArgumentList '/I AzureCLI.msi /quiet'; rm .\AzureCLI.msi` - In a new PowerShell session type `az login --identity` - Alternatively simply run `$response = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -Method GET -Headers @{Metadata="true"}` as suggested by https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-arm.md In my case the VM returns `Invoke-WebRequest : {"error":"invalid_request","error_description":"Identity not found"}` According to https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/active-directory/managed-identities-azure-resources/how-managed-identities-work-vm.md we see: System-assigned managed identity ... Creation ... Created as part of an Azure resource (for example, an Azure virtual machine or Azure App Service).

Sameer Youssef 1 Reputation point

2022-08-24T02:29:40.35+00:00

Have you had a chance to review my post below? Thanks.

srbhatta-MSFT 8,546 Reputation points Microsoft Employee

2022-08-25T11:38:49.527+00:00

Hi @Sameer Youssef , I am not able to repro this at my end. I'd recommend you to open a support case with Azure Support on this. Incase if you don't have a support plan enabled on your subscription, do let me know, and I can help you with a one-time free support.
Sign in to comment
David Broggy 5,686 Reputation points MVP

2022-08-11T03:50:32.08+00:00

Hi Sameer,
Have you seen this preview feature for automatically assigning managed identities using Azure Policy?
how-to-assign-managed-identity-via-azure-policy
Please sign in to rate this answer.
Sameer Youssef 1 Reputation point

2022-08-11T04:32:29.027+00:00

Hi David - thanks - Azure Policy seems like it could be used - but it contradicts their preference "it is recommended to use user-assigned managed identities, which can be created once and shared across multiple VMs" so I'll be hard pressed to find an example to show me how it is done.

Sameer Youssef 1 Reputation point

2022-08-15T02:34:07.113+00:00

@David Broggy I can't help but notice az login suggests:

Log in using a VM's system-assigned managed identity. az login --identity

Which lead me to believe the DevTest Lab's System Assigned identity would be pre-available on the VM.

https://ibb.co/5K5RrSH

Could it be that DevTest Lab's VM don't get assigned this identity?
Sign in to comment

Share via

How to automatically assign System-assigned managed identity to DevTest Lab Windows VM

2 answers