Support for Managed Identity

Template validation action authenticates to Azure CLI using service principal, from logs:

az login --service-principal -u "***" --federated-token $AZURE_AD_TOKEN --tenant "***"

Logged in to Azure as (***)

[
  {
    "cloudName": "***",
    "homeTenantId": "***",
    "id": "***",
    "isDefault": true,
    "managedByTenants": [],
    "name": "***",
    "state": "Enabled",
    "tenantId": "***",
    "user": {
      "name": "***",
      "type": "servicePrincipal"
    }
  }
]

My template is currently using managed identity to authenticate with the template validation workflow. In this case, -u "***" is the client-id of a managed identity (as opposed to a service principal). az login succeeds, but there seems to be some issue with permissions. The managed identity has Owner permissions on the subscription being deployed to, but the validation is failing claiming that it is missing permissions. The particular location of this failure is within post-provisioning azd hooks. Here, the template is using the local identity (in the case of the validation action, the managed identity) to perform various data-plane operations on Azure.

Perhaps this is related to logging in as a service principal with a managed identity?

Regardless, could the template validation action support managed identity? I imagine that when managed identity authentication is enabled, the az login command would change to:

az login --identity --client-id "***" --federated-token $AZURE_AD_TOKEN --tenant "***"

Start at the Azure CLI authentication entry point and review how the post-provisioning azd hooks obtain credentials for data-plane operations. Compare the current service-principal login with the requested managed-identity login, then run the template validation workflow against a managed identity; done means authentication succeeds and the hooks complete without permission errors.