<p>When rolling out my AKS cluster</p>
<pre><code>az deployment group create --template-file template.json --parameters parameters.d.json -g &lt;resource_group&gt;
</code></pre>
<p>three managed identities are created. These resources are located, by default, in the Managed Cluster resource group (with prefix <code>MC_</code>). I would like the <code>agentpool</code> managed identity (for vmss) to reside in another resource group.</p>
<p>Ideally I'd like to keep these managed identities when redeploying the cluster, however, the <code>_MC</code> resource groups are deleted and created again. Is there an option to deploy these managed identities in another resource group where they have a longer lifetime? Can this be configured in the <code>template.json</code>?</p>

Casper Dijkstra
<p>I don't know which managed identities you have because it depends on which add-ons is enabled. Most add-on identities can't be managed outside the cluster, but you can use a user-assigned identity for the kubelet and agentpool (preview) identity. Here is the <a href="https://learn.microsoft.com/en-us/azure/aks/use-managed-identity#summary-of-managed-identities" rel="nofollow noreferrer">documentation</a> of the identities for AKS, it tells for which feature you can bring your own identity.</p>
<p>Since it is in preview for the agentpool identity, I'm not sure that this can be done via an ARM tempalte yet. There is an identity field, but I suspect it's for the kubelet identity and not the agentpool. I might be wrong though, you should give it a try.</p>
