[Identity] az identity create/update: Add new --resource-restriction parameter to support identity assignment restrictions

src/azure-cli-core/azure/cli/core/profiles/_shared.py

@@ -212,7 +212,7 @@ def default_api_version(self):
         ResourceType.MGMT_SERVICEBUS: None,
         ResourceType.MGMT_EVENTHUB: None,
         ResourceType.MGMT_MONITOR: None,
-        ResourceType.MGMT_MSI: '2023-01-31',
+        ResourceType.MGMT_MSI: '2024-11-30',
         ResourceType.MGMT_APPSERVICE: '2024-11-01',
         ResourceType.MGMT_IOTHUB: None,
         ResourceType.MGMT_IOTDPS: None,

src/azure-cli/azure/cli/command_modules/identity/_help.py

@@ -19,6 +19,19 @@
   - name: Create an identity.
     text: |
         az identity create --name MyIdentity --resource-group MyResourceGroup
+
+  - name: Create an identity with resource assignment restrictions.
+    text: |
+        az identity create --name MyIdentity --resource-group MyResourceGroup --assignment-restriction '{"providers": ["Microsoft.Compute", "Microsoft.Storage/Accounts"]}'
+"""
+
+helps['identity update'] = """
+type: command
+short-summary: Update an identity.
+examples:
+  - name: Update an identity to restrict assignment to specific resources.
+    text: |
+        az identity update --name MyIdentity --resource-group MyResourceGroup --assignment-restriction '{"providers": ["Microsoft.Compute", "Microsoft.Storage/Accounts"]}'
 """
 
 helps['identity list'] = """

src/azure-cli/azure/cli/command_modules/identity/_params.py

@@ -20,3 +20,8 @@ def load_arguments(self, _):
     with self.argument_context('identity create') as c:
         c.argument('location', get_location_type(self.cli_ctx), required=False)
         c.argument('tags', tags_type)
+        c.argument('assignment_restriction', required=False, help='Identity assignment restriction, used to restrict the resources that can be assigned to the identity.')
+
+    with self.argument_context('identity update') as c:
+        c.argument('tags', tags_type)
+        c.argument('assignment_restriction', required=False, help='Identity assignment restriction, used to restrict the resources that can be assigned to the identity.')

src/azure-cli/azure/cli/command_modules/identity/aaz/latest/identity/__cmd_group.py

@@ -15,7 +15,7 @@
     "identity",
 )
 class __CMDGroup(AAZCommandGroup):
-    """Manage Managed Identity
+    """Manage Identity
     """
     pass
 

src/azure-cli/azure/cli/command_modules/identity/commands.py

@@ -22,6 +22,7 @@ def load_command_table(self, _):
     )
     with self.command_group('identity', identity_sdk, client_factory=_msi_user_identities_operations) as g:
         g.custom_command('create', 'create_identity', validator=process_msi_namespace)
+        g.generic_update_command('update', setter_name="update", custom_func_name='update_identity')
         g.show_command('show', 'get')
         g.command('delete', 'delete')
         g.custom_command('list', 'list_user_assigned_identities')

src/azure-cli/azure/cli/command_modules/identity/custom.py

@@ -3,7 +3,6 @@
 # Licensed under the MIT License. See License.txt in the project root for license information.
 # --------------------------------------------------------------------------------------------
 
-
 def list_user_assigned_identities(cmd, resource_group_name=None):
     from azure.cli.command_modules.identity._client_factory import _msi_client_factory
     client = _msi_client_factory(cmd.cli_ctx)
@@ -12,16 +11,27 @@ def list_user_assigned_identities(cmd, resource_group_name=None):
     return client.user_assigned_identities.list_by_subscription()
 
 
-def create_identity(client, resource_group_name, resource_name, location, tags=None):
+def create_identity(client, resource_group_name, resource_name, location, tags=None, assignment_restriction=None):
     parameters = {}
     parameters['location'] = location
     if tags is not None:
         parameters['tags'] = tags
+    if assignment_restriction is not None:
+        parameters['assignmentRestriction'] = assignment_restriction
     return client.create_or_update(resource_group_name=resource_group_name,
                                    resource_name=resource_name,
                                    parameters=parameters)
 
 
+def update_identity(instance, tags=None, assignment_restriction=None):
+    parameters = {}
+    if tags is not None:
+        parameters['tags'] = tags
+    if assignment_restriction is not None:
+        parameters['assignmentRestriction'] = assignment_restriction or instance.assignment_restriction
+    return parameters
+
+
 def list_identity_resources(cmd, resource_group_name, resource_name):
     from azure.cli.command_modules.identity._client_factory import _msi_list_resources_client
     client = _msi_list_resources_client(cmd.cli_ctx)

src/azure-cli/azure/cli/command_modules/identity/tests/latest/recordings/test_identity_management.yaml

@@ -11,7 +11,7 @@ interactions:
       Connection:
       - keep-alive
       User-Agent:
-      - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
+      - AZURECLI/2.77.0 azsdk-python-core/1.35.0 Python/3.12.10 (Windows-11-10.0.26100-SP0)
     method: GET
     uri: https://management.azure.com/providers/Microsoft.ManagedIdentity/operations?api-version=2023-01-31
   response:
@@ -59,7 +59,7 @@ interactions:
       content-type:
       - application/json; charset=utf-8
       date:
-      - Fri, 16 May 2025 05:47:09 GMT
+      - Thu, 23 Oct 2025 21:18:27 GMT
       expires:
       - '-1'
       pragma:
@@ -73,7 +73,7 @@ interactions:
       x-ms-operation-identifier:
       - ''
       x-msedge-ref:
-      - 'Ref A: E593170B9A3F4610B529E3C62C1FA347 Ref B: TYO201100114023 Ref C: 2025-05-16T05:47:09Z'
+      - 'Ref A: D4D8CB46ABC04C75A7D9B7E05C0417C3 Ref B: MWH011020806054 Ref C: 2025-10-23T21:18:27Z'
     status:
       code: 200
       message: OK
@@ -91,12 +91,12 @@ interactions:
       ParameterSetName:
       - -n -g
       User-Agent:
-      - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
+      - AZURECLI/2.77.0 azsdk-python-core/1.35.0 Python/3.12.10 (Windows-11-10.0.26100-SP0)
     method: GET
     uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_identity_mgmt_000001?api-version=2024-11-01
   response:
     body:
-      string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_identity_mgmt_000001","name":"cli_test_identity_mgmt_000001","type":"Microsoft.Resources/resourceGroups","location":"westus","tags":{"product":"azurecli","cause":"automation","test":"test_identity_management","date":"2025-05-16T05:47:04Z","module":"identity"},"properties":{"provisioningState":"Succeeded"}}'
+      string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_identity_mgmt_000001","name":"cli_test_identity_mgmt_000001","type":"Microsoft.Resources/resourceGroups","location":"westus","tags":{"product":"azurecli","cause":"automation","test":"test_identity_management","date":"2025-10-23T21:18:25Z","module":"identity"},"properties":{"provisioningState":"Succeeded"}}'
     headers:
       cache-control:
       - no-cache
@@ -105,7 +105,7 @@ interactions:
       content-type:
       - application/json; charset=utf-8
       date:
-      - Fri, 16 May 2025 05:47:09 GMT
+      - Thu, 23 Oct 2025 21:18:27 GMT
       expires:
       - '-1'
       pragma:
@@ -117,9 +117,9 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-ratelimit-remaining-subscription-global-reads:
-      - '3749'
+      - '16499'
       x-msedge-ref:
-      - 'Ref A: 5308D895DBA54C31A6CC6E459EAE08DF Ref B: TYO201151004029 Ref C: 2025-05-16T05:47:09Z'
+      - 'Ref A: FF0F60AC3A64418482C030F2B6851A10 Ref B: MWH011020807040 Ref C: 2025-10-23T21:18:28Z'
     status:
       code: 200
       message: OK
@@ -141,12 +141,12 @@ interactions:
       ParameterSetName:
       - -n -g
       User-Agent:
-      - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
+      - AZURECLI/2.77.0 azsdk-python-core/1.35.0 Python/3.12.10 (Windows-11-10.0.26100-SP0)
     method: PUT
     uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myidentity?api-version=2023-01-31
   response:
     body:
-      string: '{"location":"westus","tags":{},"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myidentity","name":"myidentity","type":"Microsoft.ManagedIdentity/userAssignedIdentities","properties":{"tenantId":"54826b22-38d6-4fb2-bad9-b7b93a3e9c5a","principalId":"38eac2d9-6dd6-4e7b-b8e8-acb85e6bbd8b","clientId":"c8ae5cba-7e05-46af-8b5e-6440546db094"}}'
+      string: '{"location":"westus","tags":{},"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myidentity","name":"myidentity","type":"Microsoft.ManagedIdentity/userAssignedIdentities","properties":{"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","principalId":"4cdbea58-00f3-4ca7-9f28-86e4ceb1a162","clientId":"66d17b67-7852-4d4c-8100-e7ccdc30398c"}}'
     headers:
       cache-control:
       - no-cache
@@ -155,7 +155,7 @@ interactions:
       content-type:
       - application/json; charset=utf-8
       date:
-      - Fri, 16 May 2025 05:47:13 GMT
+      - Thu, 23 Oct 2025 21:18:29 GMT
       expires:
       - '-1'
       location:
@@ -169,13 +169,13 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-operation-identifier:
-      - tenantId=54826b22-38d6-4fb2-bad9-b7b93a3e9c5a,objectId=d44a2991-98c6-47c3-b59b-2b30d72cfcc2/japanwest/7d2aa4d2-8eca-4684-aabe-da6ccd0394bd
+      - tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47,objectId=a16ec1df-b555-4191-bf58-04352f47c61d/westus/f9d97c78-876c-4c09-a108-c4e31a8c259e
       x-ms-ratelimit-remaining-subscription-global-writes:
-      - '2999'
+      - '11999'
       x-ms-ratelimit-remaining-subscription-writes:
-      - '199'
+      - '799'
       x-msedge-ref:
-      - 'Ref A: 3F1979946A524433B5AB23906EAFF0B2 Ref B: TYO201100114047 Ref C: 2025-05-16T05:47:10Z'
+      - 'Ref A: FE7BAA84E063468DB5BB6A7368C52926 Ref B: MWH011020809052 Ref C: 2025-10-23T21:18:28Z'
     status:
       code: 201
       message: Created
@@ -187,77 +187,27 @@ interactions:
       Accept-Encoding:
       - gzip, deflate
       CommandName:
-      - identity list-resources
-      Connection:
-      - keep-alive
-      Content-Length:
-      - '0'
-      ParameterSetName:
-      - -g -n
-      User-Agent:
-      - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
-    method: POST
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myidentity/listAssociatedResources?api-version=2022-01-31-preview
-  response:
-    body:
-      string: '{"totalCount":0,"value":[]}'
-    headers:
-      cache-control:
-      - no-cache
-      content-length:
-      - '27'
-      content-type:
-      - application/json; charset=utf-8
-      date:
-      - Fri, 16 May 2025 05:47:15 GMT
-      expires:
-      - '-1'
-      pragma:
-      - no-cache
-      strict-transport-security:
-      - max-age=31536000; includeSubDomains
-      x-cache:
-      - CONFIG_NOCACHE
-      x-content-type-options:
-      - nosniff
-      x-ms-operation-identifier:
-      - tenantId=54826b22-38d6-4fb2-bad9-b7b93a3e9c5a,objectId=d44a2991-98c6-47c3-b59b-2b30d72cfcc2/japanwest/2ab33c90-6b74-4bba-9b50-84ab24bd8a4c
-      x-ms-ratelimit-remaining-subscription-global-reads:
-      - '3749'
-      x-msedge-ref:
-      - 'Ref A: 337030546B1F4E44B2DCF7EB9272B02B Ref B: TYO201151006062 Ref C: 2025-05-16T05:47:13Z'
-    status:
-      code: 200
-      message: OK
-- request:
-    body: null
-    headers:
-      Accept:
-      - application/json
-      Accept-Encoding:
-      - gzip, deflate
-      CommandName:
-      - identity list
+      - identity update
       Connection:
       - keep-alive
       ParameterSetName:
-      - -g
+      - -n -g --assignment-restriction
       User-Agent:
-      - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
+      - AZURECLI/2.77.0 azsdk-python-core/1.35.0 Python/3.12.10 (Windows-11-10.0.26100-SP0)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities?api-version=2023-01-31
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myidentity?api-version=2023-01-31
   response:
     body:
-      string: '{"value":[{"location":"westus","tags":{},"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myidentity","name":"myidentity","type":"Microsoft.ManagedIdentity/userAssignedIdentities","properties":{"tenantId":"54826b22-38d6-4fb2-bad9-b7b93a3e9c5a","principalId":"38eac2d9-6dd6-4e7b-b8e8-acb85e6bbd8b","clientId":"c8ae5cba-7e05-46af-8b5e-6440546db094"}}]}'
+      string: '{"location":"westus","tags":{},"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myidentity","name":"myidentity","type":"Microsoft.ManagedIdentity/userAssignedIdentities","properties":{"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","principalId":"4cdbea58-00f3-4ca7-9f28-86e4ceb1a162","clientId":"66d17b67-7852-4d4c-8100-e7ccdc30398c"}}'
     headers:
       cache-control:
       - no-cache
       content-length:
-      - '463'
+      - '451'
       content-type:
       - application/json; charset=utf-8
       date:
-      - Fri, 16 May 2025 05:47:16 GMT
+      - Thu, 23 Oct 2025 21:18:29 GMT
       expires:
       - '-1'
       pragma:
@@ -268,44 +218,46 @@ interactions:
       - CONFIG_NOCACHE
       x-content-type-options:
       - nosniff
-      x-ms-original-request-ids:
-      - ''
       x-ms-ratelimit-remaining-subscription-global-reads:
-      - '3749'
+      - '16499'
       x-msedge-ref:
-      - 'Ref A: E1DC8F57D8DD4857A692236A332DD1C4 Ref B: TYO201151005040 Ref C: 2025-05-16T05:47:16Z'
+      - 'Ref A: FD113BE9B21C42CEA3884C783DA9E6D0 Ref B: MWH011020808054 Ref C: 2025-10-23T21:18:29Z'
     status:
       code: 200
       message: OK
 - request:
-    body: null
+    body: '{}'
     headers:
       Accept:
       - application/json
       Accept-Encoding:
       - gzip, deflate
       CommandName:
-      - identity delete
+      - identity update
       Connection:
       - keep-alive
       Content-Length:
-      - '0'
+      - '2'
+      Content-Type:
+      - application/json
       ParameterSetName:
-      - -n -g
+      - -n -g --assignment-restriction
       User-Agent:
-      - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
-    method: DELETE
+      - AZURECLI/2.77.0 azsdk-python-core/1.35.0 Python/3.12.10 (Windows-11-10.0.26100-SP0)
+    method: PATCH
     uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myidentity?api-version=2023-01-31
   response:
     body:
-      string: ''
+      string: '{"location":"westus","tags":{},"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_identity_mgmt_000001/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myidentity","name":"myidentity","type":"Microsoft.ManagedIdentity/userAssignedIdentities","properties":{"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","principalId":"4cdbea58-00f3-4ca7-9f28-86e4ceb1a162","clientId":"66d17b67-7852-4d4c-8100-e7ccdc30398c"}}'
     headers:
       cache-control:
       - no-cache
       content-length:
-      - '0'
+      - '451'
+      content-type:
+      - application/json; charset=utf-8
       date:
-      - Fri, 16 May 2025 05:47:25 GMT
+      - Thu, 23 Oct 2025 21:18:29 GMT
       expires:
       - '-1'
       pragma:
@@ -317,13 +269,13 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-operation-identifier:
-      - tenantId=54826b22-38d6-4fb2-bad9-b7b93a3e9c5a,objectId=d44a2991-98c6-47c3-b59b-2b30d72cfcc2/japanwest/a1ff696a-766d-4f72-b2b6-ebe7a223f99d
-      x-ms-ratelimit-remaining-subscription-deletes:
-      - '199'
-      x-ms-ratelimit-remaining-subscription-global-deletes:
-      - '2999'
+      - tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47,objectId=a16ec1df-b555-4191-bf58-04352f47c61d/westus/05521981-31a8-449f-9306-0e73594d52f0
+      x-ms-ratelimit-remaining-subscription-global-writes:
+      - '11999'
+      x-ms-ratelimit-remaining-subscription-writes:
+      - '799'
       x-msedge-ref:
-      - 'Ref A: 9D0CBCB4F80F4D109F7857706CB16A51 Ref B: TYO201151002029 Ref C: 2025-05-16T05:47:17Z'
+      - 'Ref A: 2A9D3092A7774D2DBA21309242E88E5A Ref B: MWH011020808023 Ref C: 2025-10-23T21:18:29Z'
     status:
       code: 200
       message: OK