# Allow for cross-tenant identity propagation in managed-application deployment

> Treat identity creation and its availability for role assignment as separate steps in the documented preview flow.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:50+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Treat identity creation and its availability for role assignment as separate steps in the documented preview flow.

## Potentially affected

Azure Managed Applications preview managed-identity deployments using the documented publisher-access flow.

## DSE recommendation

Represent the identity-propagation dependency explicitly and verify the resulting assignment before continuing deployment.

## Article

## Source facts

Managed-identity support for Azure Managed Applications is documented as preview. In the publisher-access example, Microsoft requires a delay between identity creation and role assignment because the identity must propagate between tenants. Without it, Resource Manager might not recognize the new identity in a later deployment script.

The example inserts a thirty-second sleep to represent this dependency. That is the sample’s implementation, not evidence that every deployment has been tested to finish propagation within that time. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-managed-identity).

## Applicability

Use this narrow check when following the documented preview publisher-access sequence. Identify the created identity, its home tenant, target scope and intended role. Review the full source for the chosen managed-application deployment path before adapting its sample.

## DSE recommendation

DSE recommends preserving the creation-to-assignment dependency in deployment code and recording a clear failure path when the identity is not yet recognized. Check identity and scope before retrying; do not compensate for a timing problem by assigning a broader role. Treat the sample delay as a point to validate in the intended environment, not a universal availability guarantee.

## Verification

In an approved test, record identity creation, role-assignment completion and the subsequent authorized operation separately. Reproduce the deployment sequence and inspect failures for the exact identity and target scope. Confirm the resulting permissions match the approved role before continuing the managed application. Keep sanitized timing and error evidence without retaining tokens or other credentials.

## Official references

[Microsoft Learn: Managed app with managed identity](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-managed-identity). Source retrieved September 9, 2026.

## Primary reference

- Name: Managed app with managed identity - Azure Managed Applications | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-managed-identity
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Allow for cross-tenant identity propagation in managed-application deployment,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-246-allow-for-cross-tenant-identity-propagation-in-managed-application-deployment/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.