{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/", "slug": "dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities", "url": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/" }, "title": "Plan for an ACI restart when changing managed identities", "summary": "Treat a running container group's identity update as a workload change, not just an identity setting.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:20+00:00", "modified_at": "2026-09-10T01:20:45+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 237, "potentially_affected": "Running Azure Container Instances groups whose managed identities are being enabled or updated.", "dse_recommendation": "Include the documented group restart and target-resource authorization in the identity change plan.", "primary_source": { "name": "Enable Managed Identity in a Container Group - Azure Container Instances | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents that enabling or updating managed identities on a running Container Instances group causes that group to restart. An identity change therefore has a documented runtime consequence, even when the container application itself is unchanged.

\n

Enabling the identity is separate from granting it access to an Azure resource. Microsoft’s guidance requires the identity to receive access to the service resource it will use. Microsoft Learn.

\n

Applicability

\n

Identify the exact container group, current identity configuration, intended target resource, and workload owner. Review the source’s identity setup procedure for that scenario. Do not assume that a successful identity update also demonstrates that the application has resumed useful work.

\n

DSE recommendation

\n

DSE recommends scheduling the change around the workload’s restart tolerance. Record the existing identity configuration and approved target permissions before updating the group. Ask the application owner to define how in-flight work will be checked and what evidence will demonstrate recovery. Keep credential values and access tokens out of the change record.

\n

Verification

\n

In an authorized test group, observe the identity update and resulting restart, then exercise the intended service operation from the application. Check both the approved operation and a deliberately unauthorized operation. Reconcile application progress before and after the change, and record the identity and resource scope used for the test rather than relying solely on a portal success notification.

\n

Official references

\n

Microsoft Learn: Enable Managed Identity in a Container Group. Source retrieved September 9, 2026.

", "content_text": "Source facts\nMicrosoft documents that enabling or updating managed identities on a running Container Instances group causes that group to restart. An identity change therefore has a documented runtime consequence, even when the container application itself is unchanged.\nEnabling the identity is separate from granting it access to an Azure resource. Microsoft’s guidance requires the identity to receive access to the service resource it will use. Microsoft Learn.\nApplicability\nIdentify the exact container group, current identity configuration, intended target resource, and workload owner. Review the source’s identity setup procedure for that scenario. Do not assume that a successful identity update also demonstrates that the application has resumed useful work.\nDSE recommendation\nDSE recommends scheduling the change around the workload’s restart tolerance. Record the existing identity configuration and approved target permissions before updating the group. Ask the application owner to define how in-flight work will be checked and what evidence will demonstrate recovery. Keep credential values and access tokens out of the change record.\nVerification\nIn an authorized test group, observe the identity update and resulting restart, then exercise the intended service operation from the application. Check both the approved operation and a deliberately unauthorized operation. Reconcile application progress before and after the change, and record the identity and resource scope used for the test rather than relying solely on a portal success notification.\nOfficial references\nMicrosoft Learn: Enable Managed Identity in a Container Group. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents that enabling or updating managed identities on a running Container Instances group causes that group to restart. An identity change therefore has a documented runtime consequence, even when the container application itself is unchanged.\n\nEnabling the identity is separate from granting it access to an Azure resource. Microsoft’s guidance requires the identity to receive access to the service resource it will use. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity).\n\n## Applicability\n\nIdentify the exact container group, current identity configuration, intended target resource, and workload owner. Review the source’s identity setup procedure for that scenario. Do not assume that a successful identity update also demonstrates that the application has resumed useful work.\n\n## DSE recommendation\n\nDSE recommends scheduling the change around the workload’s restart tolerance. Record the existing identity configuration and approved target permissions before updating the group. Ask the application owner to define how in-flight work will be checked and what evidence will demonstrate recovery. Keep credential values and access tokens out of the change record.\n\n## Verification\n\nIn an authorized test group, observe the identity update and resulting restart, then exercise the intended service operation from the application. Check both the approved operation and a deliberately unauthorized operation. Reconcile application progress before and after the change, and record the identity and resource scope used for the test rather than relying solely on a portal success notification.\n\n## Official references\n\n[Microsoft Learn: Enable Managed Identity in a Container Group](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/", "url": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Plan for an ACI restart when changing managed identities", "item": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/", "url": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/", "headline": "Plan for an ACI restart when changing managed identities", "description": "Treat a running container group's identity update as a workload change, not just an identity setting.", "abstract": "Treat a running container group's identity update as a workload change, not just an identity setting.", "articleBody": "Source facts\nMicrosoft documents that enabling or updating managed identities on a running Container Instances group causes that group to restart. An identity change therefore has a documented runtime consequence, even when the container application itself is unchanged.\nEnabling the identity is separate from granting it access to an Azure resource. Microsoft’s guidance requires the identity to receive access to the service resource it will use. Microsoft Learn.\nApplicability\nIdentify the exact container group, current identity configuration, intended target resource, and workload owner. Review the source’s identity setup procedure for that scenario. Do not assume that a successful identity update also demonstrates that the application has resumed useful work.\nDSE recommendation\nDSE recommends scheduling the change around the workload’s restart tolerance. Record the existing identity configuration and approved target permissions before updating the group. Ask the application owner to define how in-flight work will be checked and what evidence will demonstrate recovery. Keep credential values and access tokens out of the change record.\nVerification\nIn an authorized test group, observe the identity update and resulting restart, then exercise the intended service operation from the application. Check both the approved operation and a deliberately unauthorized operation. Reconcile application progress before and after the change, and record the identity and resource scope used for the test rather than relying solely on a portal success notification.\nOfficial references\nMicrosoft Learn: Enable Managed Identity in a Container Group. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:20+00:00", "dateModified": "2026-09-10T01:20:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Plan for an ACI restart when changing managed identities" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 237, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Enable Managed Identity in a Container Group - Azure Container Instances | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity" } } ] } }