[bogdan.trifan (bogdantrifan13)]

Related command

az containerapp update --yaml

Description

az containerapp update --yaml silently drops identity.userAssignedIdentities from the PATCH it sends. A manifest declaring

identity:
  type: UserAssigned
  userAssignedIdentities:
    "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<uami>": {}

is sent (per --debug) as "identity": {"type": "UserAssigned"}.

Cause: the update-from-YAML path runs the payload through clean_null_values, which removes every empty dict. The value of each user-assigned identity entry is legitimately {}, so the entry is removed, and then the now-empty userAssignedIdentities map is removed too:

>>> clean_null_values({'type': 'UserAssigned', 'userAssignedIdentities': {'/subscriptions/s/.../userAssignedIdentities/id': {}}})
{'type': 'UserAssigned'}

This affects update_containerapp_yaml here and the containerapp extension's ContainerAppUpdateDecorator.set_up_update_containerapp_yaml, which imports the same function. az containerapp create --yaml does not call it and is unaffected.

The service now rejects that body for apps whose registry pull identity (configuration.registries[].identity) is a user-assigned identity, with a misleading error whose "resource ID" is a NotFound body for the app itself:

(IdentityDoesNotExist) Managed Identity with resource ID '{"error":{"code":"NotFound","message":"Resource '/subscriptions/<sub>/resourcegroups/<rg>/providers/Microsoft.App/containerApps/<app>' was not found."}}' does not exist.

Every update --yaml of such an app fails, while create --yaml, or a direct PATCH of the same manifest with the identity intact, succeeds. Seen on azure-cli 2.86.0 and 2.91.0 with containerapp extension 1.3.0b5.

Change: clean_null_values keeps the entries of a userAssignedIdentities map (an identity's value cleans to {}, with null read-only fields such as principalId/clientId still stripped). An empty or null userAssignedIdentities is still removed, so all other behaviour is unchanged.

Testing Guide

• New unit test test_clean_null_values_keeps_user_assigned_identities in containerapp/tests/latest/test_containerapp_utils.py: it fails on current dev and passes with this change. The existing tests in the file still pass.
• Manual: with an existing app that has a user-assigned identity used as its registry identity, az containerapp update -n <app> -g <rg> --yaml <manifest> --debug. The PATCH body now includes identity.userAssignedIdentities.

History Notes

[ContainerApp] az containerapp update: Fix --yaml dropping identity.userAssignedIdentities, which caused IdentityDoesNotExist errors

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

🤖 Generated with Claude Code

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Thank you for your contribution bogdan.trifan (@bogdantrifan13)! We will review the pull request and get back to you soon.

[Copilot]

🟢 Approval recommended

The focused fix addresses the reported payload loss with targeted regression coverage and no unresolved findings.

No open issues 🎉

What changed in this PR

Fixes az containerapp update --yaml dropping user-assigned identities during PATCH payload cleanup.

Changes:

• Preserves identity entries whose values are empty dictionaries while still removing null fields.
• Adds regression coverage for identity preservation and empty or null identity maps.

File	Description
src/​azure-cli/​azure/​cli/​command_modules/​containerapp/​tests/​latest/​test_containerapp_utils.py	Adds identity cleanup regression tests.
src/​azure-cli/​azure/​cli/​command_modules/​containerapp/​_utils.py	Preserves user-assigned identity entries during cleanup.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The narrow fix addresses identity payload loss with focused regression coverage and no identified blocking issues.

No open issues 🎉

_{Review effort: Balanced}

[x-engineering-agent]

Hi bogdan.trifan (@bogdantrifan13),
Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

[bogdan.trifan (bogdantrifan13)]

@microsoft-github-policy-service agree

[bogdan.trifan (bogdantrifan13)]

bogdan.trifan (bogdan.trifan (@bogdantrifan13)) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree

[bogdan.trifan (bogdantrifan13)]

End-to-end verification against a real existing app (user-assigned identity used both as the app identity and as the registry pull identity), using azure-cli 2.86.0 + containerapp extension 1.3.0b5 with only clean_null_values swapped for this PR's version, and a manifest identical to the app's live state:

	Identity in PATCH body	Result
Unpatched	{"type": "UserAssigned"}	❌ IdentityDoesNotExist (every attempt)
This PR	{"type": "UserAssigned", "userAssignedIdentities": {"/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<uami>": {}}}	✅ exit 0, provisioningState: Succeeded

Note for reviewers: the empty-dict stripping is long-standing (it predates #27078 and survived #28163), so this is not a recent CLI regression. The same CLI build deployed successfully until ~2026-10-20 20:00 UTC; since then the service rejects the identity-less PATCH, which is what surfaced it.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused fix addresses the reported payload loss with regression coverage and no identified blocking issues.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The focused fix addresses the payload loss with regression coverage and no identified blocking issues.

No open issues 🎉

_{Review effort: Balanced}