[containerapp] LinkedAuthorizationFailed: The client has permission to perform action Microsoft.App/containerApps/write on scope however it does not have permission to perform action(s) Microsoft.ManagedIdentity/userAssignedIdentities/assign/action on the linked scope

Source: https://github.com/Azure/azure-cli/issues/33342 (by @arshvin)
Affected extension: `containerapp` (`src/containerapp/`)

---

<<>>
# Issue #33342 (by @arshvin)
## Title
LinkedAuthorizationFailed: The client has permission to perform action Microsoft.App/containerApps/write on scope however it does not have permission to perform action(s) Microsoft.ManagedIdentity/userAssignedIdentities/assign/action on the linked scope

## Body
### Describe the bug

`az containerapp create` command, with --yaml parameter, modifies managed identity ID, specified in that config file, by squashing underscores symbols, which leads to this managed identity cannot be found in Azure.

### Related command

`containerapp create --name bridge-test --resource-group PARTS-DIVIDED-BY-DASHES-RG_PARTS_DIVIDED_BY_UNDERSCORES --yaml /agent/_work/_temp/advanced-settings.yml`

Content of /agent/_work/_temp/advanced-settings.yml is following:
''' yaml
identity:
type: UserAssigned
userAssignedIdentities:
? /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/NAME-PARTS-DIVIDED-BY-DASHES-RG_NAME_PARTS_DIVIDED_BY_UNDERSCORES/providers/Microsoft.ManagedIdentity/userAssignedIdentities/SOME-Managed-Identity
: {}
location: westeurope
properties:
configuration:
secrets:
- identity: /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/NAME-PARTS-DIVIDED-BY-DASHES-RG_NAME_PARTS_DIVIDED_BY_UNDERSCORES/providers/Microsoft.ManagedIdentity/userAssignedIdentities/SOME-Managed-Identity
keyVaultUrl: https://some-kv.vault.azure.net/secrets/secret1
name: secret1
- identity: /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/NAME-PARTS-DIVIDED-BY-DASHES-RG_NAME_PARTS_DIVIDED_BY_UNDERSCORES/providers/Microsoft.ManagedIdentity/userAssignedIdentities/SOME-Managed-Identity
keyVaultUrl: https://some-kv.vault.azure.net/secrets/secret2
name: secret2
environmentId: /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/NAME-PARTS-DIVIDED-BY-DASHES-RG_NAME_PARTS_DIVIDED_BY_UNDERSCORES/providers/Microsoft.App/managedEnvironments/Some-Managed-Environment
template:
containers:
- env:
- name: ENV_VAR1
value: value1
- name: ENV_VAR2
value: value2
image: some-acr.azurecr.io/app:0.0.1-rc.1
name: bridge-test
resources:
cpu: !!float 0.5
memory: 1Gi
'''

### Errors

Error output looks this way in ADO pipeline with debug mode activated for `az cli`:

''' bash
2026-04-29T11:34:22.7634003Z INFO: cli.azure.cli.core.util: {"error":{"code":"LinkedAuthorizationFailed","message":"The client ... with object id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' has permission to perform action 'Microsoft.App/containerApps/write' on scope '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/NAME-PARTS-DIVIDED-BY-DASHES-RG_NAME_PARTS_DIVIDED_BY_UNDERSCORES/providers/Microsoft.App/containerApps/bridge-test'; however, it does not have permission to perform action(s) 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/NAME-PARTS-DIVIDED-BY-DASHES-RGNamePartsDividedByUnderscores/Providers/Microsoft.Managedidentity/Userassignedidentities/Some-Managed-Identity' (respectively) or the linked scope(s) are invalid."}}
'''

`NAME-PARTS-DIVIDED-BY-DASHES-RG_NAME_PARTS_DIVIDED_BY_UNDERSCORES` becomes `NAME-PARTS-DIVIDED-BY-DASHES-RGNamePartsDividedByUnderscores`

### Issue script & Debug output

In the same debug output I see following request body (formatted by me for convinience):
''' 2026-04-29T11:34:22.6034834Z INFO: cli.azure.cli.core.util: Request body:
2026-04-29T11:34:22.6037723Z INFO: cli.azure.cli.core.util: ...
'''
''' json
{
"tags": null,
"location": "westeurope",
"extendedLocation": null,
"identity": {
"principalId": null,
"tenantId": null,
"type": "UserAssigned",
"userAssignedIdentities": {
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/NAME-PARTS-DIVIDED-BY-DASHES-RGNamePartsDividedByUnderscores/Providers/Microsoft.Managedidentity/Userassignedidentities/SOME-Managed-Identity": {}
}
},
"managedBy": null,
"kind": null,
"properties": {
"environmentId": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/NAME-PARTS-DIVIDED-BY-DASHES-RG_NAME_PARTS_DIVIDED_BY_UNDERSCORES/providers/Microsoft.App/managedEnvironments/HFRSGXPTSTSPOKE01PHARMA40SABACCAE",
"configuration": {
"secrets": [
{
"name": "secret1",
"value": null,
"identity": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/NAME-PARTS-DIVIDED-BY-DASHES-RG_NAME_PARTS_DIVIDED_BY_UNDERSCORES/providers/Microsoft.ManagedIdentity/userAssignedIdentities/SOME-Managed-Identity",
"keyVaultUrl": "https://some-kv.vault.azure.net/secrets/secret1"
},
{
"name": "secret2",
"value": null,
"identity": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/NAME-PARTS-DIVIDED-BY-DASHES-RG_NAME_PARTS_DIVIDED_BY_UNDERSCORES/providers/Microsoft.ManagedIdentity/userAssignedIdentities/SOME-Managed-Identity",
"keyVaultUrl": "https://some-kv.vault.azure.net/secrets/secret2"
}
],
"activeRevisionsMode": null,
"ingress": null,
"registries": null,
"dapr": null,
"runtime": null,
"maxInactiveRevisions": null,
"service": null,
"identitySettings": null
},
"template": {
"revisionSuffix": null,
"terminationGracePeriodSeconds": null,
"initContainers": null,
"containers": [
{
"image": "some-acr.azurecr.io/app:0.0.1-rc.1",
"name": "bridge-test",
"command": null,
"args": null,
"env": [
{
"name": "ENV_VAR1",
"value": "value1",
"secretRef": null
},
{
"name": "ENV_VAR2",
"value": "value2",
"secretRef": null
} ],
"resources": {
"cpu": 0.5,
"memory": "1Gi",
"ephemeralStorage": null
},
"volumeMounts": null,
"probes": null
}
],
"scale": null,
"volumes": null,
"serviceBinds": null
},
"workloadProfileName": null,
"latestReadyRevisionName": null,
"eventStreamEndpoint": null
}
}
'''

### Expected behavior

The issue only happens with managed identity ID in `identity` mapping and does not affect on managed identity IDs of `secrets` mapping.
If change managed identity id by replacing all underscore symbols with dashes, then this issue is not appeared.

### Environment Summary

''' bash
2026-04-29T12:28:13.4076533Z Azure-cli Azure-cli-core Azure-cli-telemetry
2026-04-29T12:28:13.4077230Z ----------- ---------------- ---------------------
2026-04-29T12:28:13.4077629Z 2.71.0 2.71.0 1.1.0
'''

''' bash
2026-04-29T11:34:12.8514251Z Azure-cli Azure-cli-core Azure-cli-telemetry
2026-04-29T11:34:12.8514914Z ----------- ---------------- ---------------------
2026-04-29T11:34:12.8515273Z 2.85.0 2.85.0 1.1.0
'''
`az cli` was updated with help of dep package:

''' bash
2026-04-29T11:33:14.8180399Z Unpacking azure-cli (2.85.0-1~jammy) over (2.71.0-1~jammy) ...
'''

### Additional context

_No response_

## Comments
### Comment by @azure-client-tools-bot-prd[bot]
Hi @arshvin,

2.85.0 is not the latest Azure CLI(2.86.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

### Comment by @yonzhan

Thank you for opening this issue, we will look into it.

### Comment by @github-actions[bot]
Here are some similar issues that might help you. Please check if they can solve your problem.
- #26560

_Powered by [issue-sentinel](https://github.com/Azure/issue-Sentinel)_

### Comment by @a0x1ab
> 🤖 *This comment was posted by the Agent Assist bot (GitHub Copilot CLI). Human review is required before any PR is merged.*

## �� Bug Analysis — Issue #33342

**Module:** `azure-cli` → `containerapp` (`az containerapp create --yaml`)

**Root cause:** When `--yaml` is used, the YAML key for `identity.userAssignedIdentities` is a resource ID used as a mapping key (YAML `? key: {}` syntax). Azure CLI's YAML-to-model serialization applies a camelCase normalization to dictionary keys, which incorrectly converts underscored resource group name segments (e.g. `_NAME_PARTS_DIVIDED_BY_UNDERSCORES`) into camelCase (`NamePartsDividedByUnderscores`). This corrupts the managed identity resource ID sent to the ARM API. The bug only affects `identity.userAssignedIdentities` keys (not `secrets[].identity` string values).

**Affected file(s):** Likely `src/azure-cli/azure/cli/command_modules/containerapp/` — the YAML deserialization / model-building code that processes `identity.userAssignedIdentities`.

**Suggested fix:** Preserve raw string keys in `userAssignedIdentities` without applying camelCase normalization — ARM resource ID strings must remain case/underscore-exact.

Assigning Copilot to investigate and fix. 🚀

<<>>