in IIS manager UI, you cannot use Azure AAD EntraID?

contact Jason Xu
Fix: add a note to

- [ ] [Shared Configuration with IIS 7](https://learn.microsoft.com/en-us/iis/manage/managing-your-configuration-settings/shared-configuration_264)
- [ ] [Application Pool Identities](https://learn.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities)
- [ ] [Step 2: Configure IIS Web Farm Servers](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj129399(v=ws.11)#to-configure-shared-content)]

that states the User Name must be a local or Windows Active Directory user and not a Microsoft Entra ID to this page. Make an include file we can easily add/edit.

Once the Shared configuration uses Azure AAD EntraID, the UI allows you to do so, but w3svc and WAS cannot be started after that.

The app pool identity also allows Entra ID be input and customer even has web apps running with that. But as the [document](https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/www-administration-management/default-permissions-user-rights) requires, that needs the GPOs list in the doc and those cannot even be assigned to the EntraID and so we do not know what problem it will be later.

I think this could become more and more common later since customers are moving to Azure. If we can have a clear document states those areas IIS Management console cannot use Azure AAD EntraID, it can avoid a lot of arguments from customers.

contact Jason Xu

---
[Associated WorkItem - 400570](https://dev.azure.com/msft-skilling/Content/_workitems/edit/400570)