az webapp identity assign not working

[carlhoogstoel]

Describe the bug

az webapp identity assign --name name --resource-group resourcegroup fails with following message:

Also, setting the toggle for the web app under Identity through the portal also returns the same issue.

User context is owner.

Any advice would be welcome

Related command

az webapp identity assign

Errors

(FailedIdentityOperation) Identity operation for resource '/subscriptions/subscription/resourceGroups/resourcegroup/providers/Microsoft.Web/sites/webapp' failed with error 'Failed to perform resource identity operation. Status: 'BadRequest'. Response: '{"error":{"code":"BadRequest","message":"Bad request."}}'.'.
Code: FailedIdentityOperation

Issue script & Debug output

debug.txt

Expected behavior

To enable the system managed identity option on the web app or to be able to create a user managed identity in the tenant. Both options fail.

Environment Summary

azure-cli 2.74.0 *

core 2.74.0 *
telemetry 1.1.0

Extensions:
azure-devops Unknown
communication Unknown

Dependencies:
msal 1.32.3
azure-mgmt-resource 23.3.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\USER.azure'
Extensions directory 'C:\Users\USER.azure\cliextensions'

Python (Windows) 3.12.10 (tags/v3.12.10:0cc8128, Apr 8 2025, 12:21:36) [MSC v.1943 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal

Additional context

No response

[azure-client-tools-bot-prd]

Hi @carlhoogstoel,

2.74.0 is not the latest Azure CLI(2.75.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[carlhoogstoel]

I have done the upgrade to 2.74.0 and the result of the enable identity for the web app command is the same: FailedIdentityOperation - BadRequest.

Command: az webapp identity assign --name WEBAPP --resource-group RESOURCEGROUP

Doing it through the portal gives the same result.

[carlhoogstoel]

Tried just creating a user managed identity in the tenant.

Command: az identity create --name idtest --resource-group RESOURCEGROUP --debug

Only thing that comes out is a dry "Bad Request". No details, no info , no nothing.

Very frustrating.

Can someone please just give a hint or some explenation what we are doing wrong? We are completly stuck on this.

debug2.txt

[carlhoogstoel]

You can close the issue.

The Managed Service Identity was not set to true.

Would be helpfull if this was mentioned in the docs.