# Plan for an ACI restart when changing managed identities

> Treat a running container group's identity update as a workload change, not just an identity setting.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:20+00:00
- Modified: 2026-09-10T01:20:45+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Treat a running container group's identity update as a workload change, not just an identity setting.

## Potentially affected

Running Azure Container Instances groups whose managed identities are being enabled or updated.

## DSE recommendation

Include the documented group restart and target-resource authorization in the identity change plan.

## Article

## Source facts

Microsoft documents that enabling or updating managed identities on a running Container Instances group causes that group to restart. An identity change therefore has a documented runtime consequence, even when the container application itself is unchanged.

Enabling the identity is separate from granting it access to an Azure resource. Microsoft’s guidance requires the identity to receive access to the service resource it will use. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity).

## Applicability

Identify the exact container group, current identity configuration, intended target resource, and workload owner. Review the source’s identity setup procedure for that scenario. Do not assume that a successful identity update also demonstrates that the application has resumed useful work.

## DSE recommendation

DSE recommends scheduling the change around the workload’s restart tolerance. Record the existing identity configuration and approved target permissions before updating the group. Ask the application owner to define how in-flight work will be checked and what evidence will demonstrate recovery. Keep credential values and access tokens out of the change record.

## Verification

In an authorized test group, observe the identity update and resulting restart, then exercise the intended service operation from the application. Check both the approved operation and a deliberately unauthorized operation. Reconcile application progress before and after the change, and record the identity and resource scope used for the test rather than relying solely on a portal success notification.

## Official references

[Microsoft Learn: Enable Managed Identity in a Container Group](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity). Source retrieved September 9, 2026.

## Primary reference

- Name: Enable Managed Identity in a Container Group - Azure Container Instances | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Plan for an ACI restart when changing managed identities,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-216-plan-for-an-aci-restart-when-changing-managed-identities/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.