Skip to content

Commit eb96c4d

Browse files
authored
Update alert type for security considerations
Replaced 'IMPORTANT' alert with 'CAUTION' alert to emphasize security considerations regarding managed identity authentication.
1 parent 92f51cd commit eb96c4d

1 file changed

Lines changed: 1 addition & 2 deletions

File tree

articles/api-management/authentication-managed-identity-policy.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,8 @@ Both system-assigned identity and any of the multiple user-assigned identities c
2020

2121
[!INCLUDE [api-management-policy-generic-alert](../../includes/api-management-policy-generic-alert.md)]
2222

23-
> [!IMPORTANT]
23+
> [!CAUTION]
2424
> **Security consideration:** Any user with permissions to edit API Management policies (for example, users assigned the [API Management Service Contributor](/azure/role-based-access-control/built-in-roles#api-management-service-contributor) role) can use this policy to authenticate as the service's managed identity. This effectively grants that user access to any resource for which the managed identity has permissions. Ensure that you follow the [principle of least privilege](/entra/identity-platform/secure-least-privileged-access) when assigning permissions to API Management resource. For more information, see [How to use managed identities in Azure API Management](api-management-howto-use-managed-service-identity.md).
25-
2625
2726
## Policy statement
2827

0 commit comments

Comments
 (0)