Skip to content

Commit f169207

Browse files
Clarify managed identities permissions and role membership cache verbiage in overview-managed-identity.md.
Update overview-managed-identity.md to describe the caching behavior of managed identity role memberships and permissions more clearly. The previous language misused the word "several" to refer to values up to 24, which is confusing.
1 parent a179715 commit f169207

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

articles/app-service/overview-managed-identity.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ Some services use mechanisms other than Azure role-based access control. To unde
262262
For example, if you [request a token](#connect-to-azure-services-in-app-code) to access a secret in Azure Key Vault, you must also create a role assignment that allows the managed identity to work with secrets in the target vault. Otherwise, Key Vault rejects your calls even if you use a valid token. The same is true for Azure SQL Database and other services.
263263

264264
> [!IMPORTANT]
265-
> The back-end services for managed identities maintain a cache per resource URI for around 24 hours. It can take several hours for changes to a managed identity's group or role membership to take effect. It's currently not possible to force a managed identity's token to be refreshed before its expiration. If you change a managed identity's group or role membership to add or remove permissions, you might need to wait several hours for the Azure resource that's using the identity to have the correct access.
265+
> The back-end services for managed identities maintain a cache per resource URI for around 24 hours and can take up to that amount of time for changes to a managed identity's group or role membership to take effect. It's currently not possible to force a managed identity's token to be refreshed before its expiration. If you change a managed identity's group or role membership to add or remove permissions, you might need to wait up to around 24 hours for the Azure resource that's using the identity to have the correct access.
266266
>
267267
> For alternatives to groups or role memberships, see [Limitation of using managed identities for authorization](/entra/identity/managed-identities-azure-resources/managed-identity-best-practice-recommendations#limitation-of-using-managed-identities-for-authorization).
268268

0 commit comments

Comments
 (0)