title: Is it possible to assign a system managed identity to an Azure AD Enterprise Application that requires user assignment?
body: <p>I have an Azure Function app that uses the integrated Azure AD Authentication configured via the Azure portal.</p>
  <p>Via the &quot;Express&quot; mode setup, this creates an Azure App Registration along with Enterprise Application.</p>
  <p>By default, this Enterprise Application accepts all users. So that means all users in the tenant can trigger the protected Azure Functions, which is not what I wanted.</p>
  <p>My goal is to allow certain users and certain Azure resources in the tenant which have Managed Identities, such as an App Service, to trigger the function.</p>
  <p>So I go to the Enterprise Application settings of the Azure Function app, changed its properties to &quot;User Assignment Required&quot;. Then under Users/Groups, I can add users/groups that are allowed to authenticate.</p>
  <p>Here I found out that I can only add regular AAD users. The managed identity service principals (i.e., the system assigned managed identity principals for my App Service) do not show up on the list.</p>
  <p>I have not tried user-assigned managed identities. But I prefer using system-assigned managed identities.</p>
  <p>Is this a supported scenario?</p>