Azure Virtual Machine Scale Sets
Azure compute resources that are used to create and manage groups of heterogeneous load-balanced virtual machines.
Message: The value 'SystemAssigned, UserAssigned' of parameter 'identity' is not allowed. Allowed values are: UserAssigned, None.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 28.000000000000004%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAP%3C/text%3E%3C/svg%3E)
Anthony Pirolli
0
Reputation points Microsoft Employee
Message: The value 'SystemAssigned, UserAssigned' of parameter 'identity' is not allowed. Allowed values are: UserAssigned, None.
I am unable to enabled SystemAssigned Identity on my VMSS even though the API version I am using says this is an allowed parameter.
Can I have some assistance on why this is the case?
The end goal is to deploy EntraID extension to login to our Linux type VMSS.
Azure Virtual Machine Scale Sets
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 64%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDR%3C/text%3E%3C/svg%3E)
Durga Reshma Malthi 9,595 Reputation points Microsoft External Staff Moderator2025-08-11T16:42:59.8933333+00:00 If you are using a bicep template, ensure that the identity block must be structured correctly to support both identity types.
identity: { type: 'SystemAssigned, UserAssigned' userAssignedIdentities: { '/subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<identity-name>': {} } }And as per this GitHub document - https://github.com/Azure/bicep-registry-modules/issues/2671, it was mentioned that you cannot use a system-assigned identity with
orchestrationMode: 'Flexible'but must use Uniform.Additional References:
https://stackoverflow.com/questions/70165163/assigning-user-assigned-identity-to-azure-vmss-fails
Hope this helps!
Please Let me know if you have any queries.
-
Anthony Pirolli 0 Reputation points Microsoft Employee
2025-08-11T17:06:04.5866667+00:00 Yes our bicep template is like this
var identity = IdentityType == 'SystemAssigned' || IdentityType == 'None' ? { type: IdentityType } : { type: IdentityType userAssignedIdentities: !empty(UserAssignedIdentities) ? UserAssignedIdentities : null }If we are inputting SystemAssigned, or None then type is just set however if UserAssigned is in the IdentityType then it will set the userAssignedIdentities. I have no issues when IdentityType is 'UserAssigned' like this.
-
Anthony Pirolli 0 Reputation points Microsoft Employee
2025-08-11T17:10:45.4433333+00:00 Looking at further notice, it is a Flexible orchestration however on a one off basis I am able to enable System Assigned MI on the individual VMs. Is there anyway to do this automatically while keeping the VMSS in a flexible measure?
-
Durga Reshma Malthi 9,595 Reputation points Microsoft External Staff Moderator
2025-08-12T10:05:12.6366667+00:00 As per this GitHub document - https://github.com/Azure/bicep-registry-modules/issues/2671, it was mentioned that you cannot use a system-assigned identity with
orchestrationMode: 'Flexible'but must use Uniform.Flexible orchestration does not support System Assigned at the VMSS resource itself , the identity has to be enabled per VM instance.
- Uniform orchestration - Identity is managed at the scale set level.
- Flexible orchestration - Identity must be managed per VM instance.
But Bicep or ARM templates cannot assign System Assigned identity to individual VMSS instances during initial deployment in Flexible mode. You’ll need to use CLI, PowerShell, or REST API post-deployment.
However, you can try this bicep template - https://learn.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachinescalesets?pivots=deployment-language-bicep, but ensure you might configure the identity.
resource vmss 'Microsoft.Compute/virtualMachineScaleSets@2021-03-01' = { name: 'myVMSS' location: resourceGroup().location sku: { name: 'Standard_DS1_v2' tier: 'Standard' capacity: 2 } properties: { virtualMachineProfile: { identity: { type: 'SystemAssigned' } // Other VMSS properties } } }Additional References:
Hope this helps!
Please Let me know if you have any queries.
Sign in to comment
Sign in to answer