Fetch Azure Managed Identity from within Function

Question

I am using Azure Managed Identity feature for my python Azure Functions App and would like to be able to fetch currently assigned Client ID from within the Function App itself.

Search through documentation and azure-identity python sources did not give result I would expect.

Maybe I could:

1. Query Azure Instance Metadata Service myself to get this ID. (not really happy with this option)
2. Provision it as env variable during ARM deployment stage/ or by hands later on. (seems good and efficient, but not sure what is the best practice here)

UPDATE

Managed o get it working with ARM template and env variable

1. Deploys FunctionApp with System Identity
2. Provisions System Identity as env variable of this same FunctionApp

Idea is to use Microsoft.Resources/deployments subtemplate to update Function App configuration with:

{
    "name": "AZURE_CLIENT_ID",
    "value": "[reference(resourceId('Microsoft.Web/sites', variables('appName')), '2019-08-01', 'full').identity.principalId]"
},

Answer 1

The simplest option is to go to the identity tab for your Functions app, and turn on "System assigned managed identity". You can then get the access token without having to provide the client_id, since the token request simply picks the system assigned identity if there is one for the Function app.

If you are using "user assigned managed identity", then you need to provide the client_id: either through env or directly in your code.

You may already be aware, but just an additional note: that you also need to make sure you have given access to your managed identity for the resource you are accessing, for example: going to the Azure resource your Function app needs to access and assigning an appropriate role for your managed identity.

your option 1 (query Azure Instance Metadata Service), is only available on VMs.

UPDATE

Since you need the client_id for other purposes, you may also consider reading it from the response to your request for the access token: client_id is one of the parameters in the JSON token returned to you along with the access token, and its value is the client_id of the managed identity you used (in your case, the system-assigned managed identity)

Here is a sample token response to illustrate this:

 {
  access_token: <...>,
  resource: <...>,
  token_type: 'Bearer',
  client_id: <client_id of the managed identity used to get this token>
}