[Feature]: Support system-assigned managed identity in VM/Arc Run Command cmdlets

[mvanhilst-msft]

Description of the new feature

The {New,Update,Invoke}-AzConnectedMachineRunCommand and {Set,Invoke}-AzVmRunCommand cmdlets support using user-assigned managed identities to retrieve a script from Azure Storage via the -ScriptUriManagedIdentityClientId and -ScriptUriManagedIdentityObjectId parameters. It does not appear there is a way to use a system-assigned managed identity via these parameters.

The support for user-assigned managed identities in the ConnectedMachine cmdlets is great, except for one small problem: as far as I can tell, Arc servers still don't support user-assigned managed identities. So this feature is currently useless for those cmdlets.

The underlying VM and Arc RunCommand REST APIs supposedly supports system-assigned managed identities via the JSON payload:

{
  "location": "West US 2",
  "properties": {
    "source": {
      "scriptUri": "...",
      "scriptUriManagedIdentity": {}
    }
  }
}

scriptUriManagedIdentity: User-assigned managed identity that has access to scriptUri in case of Azure storage blob. Use an empty object in case of system-assigned identity.

https://learn.microsoft.com/en-us/rest/api/hybridcompute/machine-run-commands/create-or-update?view=rest-hybridcompute-2025-01-13&tabs=HTTP#machineruncommandscriptsource

However, when I try this via the -JsonString parameter, I receive "The request does not have sufficient information to complete the operation. Missing or invalid properties: ScriptUriManagedIdentity is not valid: Exactly one property should be populated between CientId and ObjectId.."

Proposed implementation details (optional)

It would be nice if we had a -ScriptUriManagedIdentity switch to simplify this.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @Drewm3, @TravisCragg-MSFT, @nikhilpatel909, @sandeepraichura, @hilaryw29, @GabstaMSFT.

[mvanhilst-msft]

I was able to confirm that the documentation is incorrect and the Arc RunCommand REST APIs do not support system-assigned managed identities at all. It is the REST API itself that is returning ScriptUriManagedIdentity is not valid: Exactly one property should be populated between CientId and ObjectId. Then, if I provide any GUID in ClientId/ObjectId (even though Arc doesn't support user-assigned managed identities), the REST API returns an error about being unable to connect to the managed identity IMDS (since the Arc implementation is at a different URL). It seems like a copy-paste job from the VM RunCommands without regard for the nuances of Arc.

In other words, the ScriptUri managed identity feature does not work at all in Arc RunCommands, even outside the scope of the Az PowerShell module.

Where should I submit this bug report?

[GabstaMSFT]

@mvanhilst-msft thank you for your request, I am reviewing it with the dev team.