@@ -1,5 +1,5 @@ ----title: Assignment restriction for managed identities (Preview)+title: Assignment restriction for managed identities (preview) description: Learn how assignment restrictions scope a user-assigned managed identity to one or more resource providers to improve security and resilience. author: mmacy-msft ms.author: marshmacy@@ -7,68 +7,16 @@ ms.service: entra-id ms.subservice: managed-identities ms.topic: concept-article ms.custom: msecd-doc-authoring-10012-ms.date: 04/24/2026+ms.date: 07/10/2026 ai-usage: ai-assisted  #customer intent: As an Azure administrator, I want to understand assignment restriction for user-assigned managed identities so that I can scope identity usage to one or more resource providers and reduce security and operational risk.  ----## Note about supported Resource Providers and Resource Types in the Azure portal -> [!NOTE]-> Selecting **None** for resource assignment restrictions leaves the identity unrestricted, allowing it to be assigned to resources from any resource provider that supports managed identities.->-> Configure resource assignment restrictions only when you want to limit identity assignment to specific resource providers. Be aware that the **Select Resource Types** list in the Azure portal may not include all supported resource providers and resource types.--The **Select Resource Types** pane in the Azure portal does not display all resource providers and resource types that support managed identities. If the resource you want to configure is not listed, use the Azure CLI to create or update the identity assignment. Refer to the Azure CLI examples below for resources that are not currently available in the **Select Resource Types** list.--### Create an identity with resource assignment restrictions--```bash-az identity create \-  --name MyIdentity \-  --resource-group MyResourceGroup \-  --resource-restriction '{"providers": ["Microsoft.Compute", "Microsoft.Storage/Accounts"]}'-```--### Update an identity to restrict assignment to specific resources--```bash-az identity update \-  --name MyIdentity \-  --resource-group MyResourceGroup \-  --resource-restriction '{"providers": ["Microsoft.Compute", "Microsoft.Storage/Accounts"]}'-```--### List the associated resources for an identity--```bash-az identity list-resources \-  --name MyIdentity \-  --resource-group MyResourceGroup-```--### Create an unrestricted identity+# Assignment restriction for user-assigned managed identities (preview) -```bash-az identity create \---name MyIdentity \---resource-group MyResourceGroup \---resource-restriction '{"providers": []}'-```--### Remove all resource provider restrictions from an identity--```bash-az identity update \---name MyIdentity \---resource-group MyResourceGroup \---resource-restriction '{"providers": []}'-```--# Assignment restriction for user-assigned managed identities (Preview)--Assignment restrictions, also known as resource restrictions, are a security feature for user-assigned managed identities that limit the resource providers an identity can be assigned to. It is currently a public preview feature. Assignment restrictions let you isolate a managed identity to one or more resource providers so that it can't be reused across unrelated services.+Assignment restrictions, also known as resource restrictions, are a security feature for user-assigned managed identities that limit the resource providers an identity can be assigned to. Assignment restrictions are currently in preview. They let you isolate a managed identity to one or more resource providers so that it can't be reused across unrelated services.  When you configure assignment restriction, managed identity usage stays tightly scoped. This scoping reduces the blast radius of a compromised or misconfigured identity and helps improve both security and resilience. @@ -138,6 +86,15 @@ Consider the following best practices when you plan assignment restriction for u - Match managed identity scope to the intended source resources only. - Avoid reusing managed identities across unrelated workloads for convenience. +## Supported resource providers and resource types in the Azure portal++> [!NOTE]+> Selecting **None** for resource assignment restrictions leaves the identity unrestricted, allowing it to be assigned to resources from any resource provider that supports managed identities.+>+> Configure resource assignment restrictions only when you want to limit identity assignment to specific resource providers. The **Select Resource Types** list in the Azure portal might not include all supported resource providers and resource types.++If the resource provider or resource type you want to configure isn't listed in the **Select Resource Types** pane, use the Azure CLI. For configuration steps and command examples, see [Configure assignment restriction for user-assigned managed identities](configure-managed-identities-assignment-restriction.md).+ ## Related content  - [Configure assignment restriction for user-assigned managed identities](configure-managed-identities-assignment-restriction.md)