Share via

We use Azure Container Apps (ACA) with Azure Files mounts to serve Neo4j graph databases. The ACA ARM API requires a storage account key to register file share mounts — there is no managed identity or Entra ID alternative. This blocks us from setting `all

Dylan Rodriguez Barboza 20 Reputation points Microsoft Employee
2026-03-26T22:09:32.1566667+00:00

Background We use Azure Container Apps (ACA) with Azure Files mounts to serve Neo4j graph databases. The ACA ARM API requires a storage account key to register file share mounts — there is no managed identity or Entra ID alternative. This blocks us from setting allowSharedKeyAccess: false on our storage account, which is required by an S360 compliance item.

 

Specific API Gap The CLI command: az containerapp env storage set \     --name <aca-env> \     --resource-group <rg> \     --storage-name <mount-name> \     --azure-file-account-name <account> \     --azure-file-account-key <key>         ← no MI alternative     --azure-file-share-name <share> \     --access-mode ReadWrite

 

The underlying ARM API Microsoft.App/managedEnvironments/storages (AzureFileProperties) requires accountKey as a string parameter. Verified through API versions up to 2026-01-01 — no identity or resourceId field exists.

 

At runtime, ACA also uses the cached key to authenticate SMB mounts when containers start. If allowSharedKeyAccess: false, mounts fail and containers can't access data.

ADO work item applied to ACI (should apply also for ACA): https://msazure.visualstudio.com/One/_workitems/edit/28139157

We have the following questions:

  • Will it be managed identity support for Azure Files mounts on the ACA roadmap? if so, which API or timeline will it be delivered.
  • Is there any alternative auth mechanism that works with managedEnvironments/storages today?
Azure Container Apps
Azure Container Apps

An Azure service that provides a general-purpose, serverless container platform.

Answer accepted by question author

  1. Pravallika KV 14,235 Reputation points Microsoft External Staff Moderator
    2026-03-26T22:37:32.1733333+00:00

    Hi @Dylan Rodriguez Barboza ,

    Thanks for reaching out to Microsoft Q&A.

    Here's the update received from the product team regarding your query:

    Currently, using Managed Identity to connect to Azure Files is not supported. This capability from Azure Files is still in preview - Use Managed Identities with Azure Files – Preview | Microsoft Learn. We currently don't have it in our backlog.

    However, you may submit an exception request, which will be reviewed and approved accordingly.

    Hope this helps!

    If the resolution was helpful, kindly take a moment to click on User's imageand click on Yes for was this answer helpful. And, if you have any further query do let us know.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.