manager: martinco
Day in brief
11 September: Workload ID clarified RBAC boundaries and identity-deletion cleanup; no feature rollout
This was a documentation-focused day, with the most useful updates affecting Microsoft Entra Workload ID managed identities. Updated guidance clarifies service-specific Azure RBAC and data-plane support, and explains that deleting a user-assigned managed identity does not remove its resource references. Three Microsoft Learn pages were removed, but the supplied evidence does not indicate a preview, general-availability launch, security advisory, changed platform behavior, or retirement of an underlying capability.
- Workload ID access guidance reinforces Azure RBAC and service-specific data-plane caveats
Workload ID · FundamentalsThe updated portal guidance says to grant managed-identity access through Azure RBAC and consult the specific service documentation, because some Azure services are still adopting Azure RBAC on the data plane. This is a documentation clarification rather than evidence of a new tenant-wide capability or setting; validate the supported access path for the service being configured.
- Workload ID documents the separate cleanup required after deleting a user-assigned managed identity
Workload ID · GeneralThe updated Azure CLI guidance states that deleting a user-assigned managed identity does not remove references to it from assigned resources. Those references must be removed from the resource itself; the page gives VM and virtual machine scale set identity-removal commands as examples. This clarifies operational behavior and is relevant to identity-deletion runbooks.
- An Entra ID access-assignment page was removed
Entra ID · GeneralThe Microsoft Learn page titled “Assign Access Azure Resource” was removed. The record identifies this as a documentation retirement, not a product-capability retirement, and does not identify a replacement. Administrators who use the page in internal procedures or links should locate and update those references.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
9 updates
Microsoft Entra ID
2 updatesAssign Access Azure Resource
RemovedA Microsoft Entra documentation page was updated: Assign Access Azure Resource.
Microsoft Entra Workload ID
7 updatesStep-by-step instructions on using PowerShell to assign a managed identity access to an Azure resource or another resource.
Deleting a user-assigned managed identity won't remove the reference from any resource it was assigned to. Remove those from the resource itself. For example, for a VM or virtual machine scale set, use the `az vm/vmss identity remove` command.
A Microsoft Entra documentation page was updated: Assign App Role Managed Identity.
A Microsoft Entra documentation page was updated: How Manage User Assigned Managed Identities.
- If you're unfamiliar with managed identities for Azure resources, see [Managed identity for Azure resources overview](./overview.md).
- If you're unfamiliar with managed identities for Azure resources, see [Managed identity for Azure resources overview](./overview.md).
The steps outlined below show how you grant access to a service using Azure RBAC. Check specific service documentation on how to grant access; for example, check [Azure Data Explorer](/azure/data-explorer/data-explorer-overview) for instructions. Some Azure services are in the process of adopting Azure RBAC on the data plane.