{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/", "slug": "dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment", "url": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/" }, "title": "Allow for cross-tenant identity propagation in managed-application deployment", "summary": "Treat identity creation and its availability for role assignment as separate steps in the documented preview flow.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:50+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 244, "potentially_affected": "Azure Managed Applications preview managed-identity deployments using the documented publisher-access flow.", "dse_recommendation": "Represent the identity-propagation dependency explicitly and verify the resulting assignment before continuing deployment.", "primary_source": { "name": "Managed app with managed identity - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-managed-identity", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Managed-identity support for Azure Managed Applications is documented as preview. In the publisher-access example, Microsoft requires a delay between identity creation and role assignment because the identity must propagate between tenants. Without it, Resource Manager might not recognize the new identity in a later deployment script.

\n

The example inserts a thirty-second sleep to represent this dependency. That is the sample’s implementation, not evidence that every deployment has been tested to finish propagation within that time. Microsoft Learn.

\n

Applicability

\n

Use this narrow check when following the documented preview publisher-access sequence. Identify the created identity, its home tenant, target scope and intended role. Review the full source for the chosen managed-application deployment path before adapting its sample.

\n

DSE recommendation

\n

DSE recommends preserving the creation-to-assignment dependency in deployment code and recording a clear failure path when the identity is not yet recognized. Check identity and scope before retrying; do not compensate for a timing problem by assigning a broader role. Treat the sample delay as a point to validate in the intended environment, not a universal availability guarantee.

\n

Verification

\n

In an approved test, record identity creation, role-assignment completion and the subsequent authorized operation separately. Reproduce the deployment sequence and inspect failures for the exact identity and target scope. Confirm the resulting permissions match the approved role before continuing the managed application. Keep sanitized timing and error evidence without retaining tokens or other credentials.

\n

Official references

\n

Microsoft Learn: Managed app with managed identity. Source retrieved September 9, 2026.

", "content_text": "Source facts\nManaged-identity support for Azure Managed Applications is documented as preview. In the publisher-access example, Microsoft requires a delay between identity creation and role assignment because the identity must propagate between tenants. Without it, Resource Manager might not recognize the new identity in a later deployment script.\nThe example inserts a thirty-second sleep to represent this dependency. That is the sample’s implementation, not evidence that every deployment has been tested to finish propagation within that time. Microsoft Learn.\nApplicability\nUse this narrow check when following the documented preview publisher-access sequence. Identify the created identity, its home tenant, target scope and intended role. Review the full source for the chosen managed-application deployment path before adapting its sample.\nDSE recommendation\nDSE recommends preserving the creation-to-assignment dependency in deployment code and recording a clear failure path when the identity is not yet recognized. Check identity and scope before retrying; do not compensate for a timing problem by assigning a broader role. Treat the sample delay as a point to validate in the intended environment, not a universal availability guarantee.\nVerification\nIn an approved test, record identity creation, role-assignment completion and the subsequent authorized operation separately. Reproduce the deployment sequence and inspect failures for the exact identity and target scope. Confirm the resulting permissions match the approved role before continuing the managed application. Keep sanitized timing and error evidence without retaining tokens or other credentials.\nOfficial references\nMicrosoft Learn: Managed app with managed identity. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nManaged-identity support for Azure Managed Applications is documented as preview. In the publisher-access example, Microsoft requires a delay between identity creation and role assignment because the identity must propagate between tenants. Without it, Resource Manager might not recognize the new identity in a later deployment script.\n\nThe example inserts a thirty-second sleep to represent this dependency. That is the sample’s implementation, not evidence that every deployment has been tested to finish propagation within that time. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-managed-identity).\n\n## Applicability\n\nUse this narrow check when following the documented preview publisher-access sequence. Identify the created identity, its home tenant, target scope and intended role. Review the full source for the chosen managed-application deployment path before adapting its sample.\n\n## DSE recommendation\n\nDSE recommends preserving the creation-to-assignment dependency in deployment code and recording a clear failure path when the identity is not yet recognized. Check identity and scope before retrying; do not compensate for a timing problem by assigning a broader role. Treat the sample delay as a point to validate in the intended environment, not a universal availability guarantee.\n\n## Verification\n\nIn an approved test, record identity creation, role-assignment completion and the subsequent authorized operation separately. Reproduce the deployment sequence and inspect failures for the exact identity and target scope. Confirm the resulting permissions match the approved role before continuing the managed application. Keep sanitized timing and error evidence without retaining tokens or other credentials.\n\n## Official references\n\n[Microsoft Learn: Managed app with managed identity](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-managed-identity). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/", "url": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Allow for cross-tenant identity propagation in managed-application deployment", "item": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/", "url": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/", "headline": "Allow for cross-tenant identity propagation in managed-application deployment", "description": "Treat identity creation and its availability for role assignment as separate steps in the documented preview flow.", "abstract": "Treat identity creation and its availability for role assignment as separate steps in the documented preview flow.", "articleBody": "Source facts\nManaged-identity support for Azure Managed Applications is documented as preview. In the publisher-access example, Microsoft requires a delay between identity creation and role assignment because the identity must propagate between tenants. Without it, Resource Manager might not recognize the new identity in a later deployment script.\nThe example inserts a thirty-second sleep to represent this dependency. That is the sample’s implementation, not evidence that every deployment has been tested to finish propagation within that time. Microsoft Learn.\nApplicability\nUse this narrow check when following the documented preview publisher-access sequence. Identify the created identity, its home tenant, target scope and intended role. Review the full source for the chosen managed-application deployment path before adapting its sample.\nDSE recommendation\nDSE recommends preserving the creation-to-assignment dependency in deployment code and recording a clear failure path when the identity is not yet recognized. Check identity and scope before retrying; do not compensate for a timing problem by assigning a broader role. Treat the sample delay as a point to validate in the intended environment, not a universal availability guarantee.\nVerification\nIn an approved test, record identity creation, role-assignment completion and the subsequent authorized operation separately. Reproduce the deployment sequence and inspect failures for the exact identity and target scope. Confirm the resulting permissions match the approved role before continuing the managed application. Keep sanitized timing and error evidence without retaining tokens or other credentials.\nOfficial references\nMicrosoft Learn: Managed app with managed identity. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:50+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Allow for cross-tenant identity propagation in managed-application deployment" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Managed app with managed identity - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-managed-identity" } } ] } }