User assigned managed identities
APPLIES TO: 
Azure Database for PostgreSQL - Flexible Server
This article provides step-by-step instructions to add or remove user assigned managed identities to an Azure Database for PostgreSQL flexible server.
Steps to assign to existing servers
This article assumes you created the user assigned managed identities that you want to associate to an existing instance of Azure Database for PostgreSQL flexible server.
For more information, see how to manage user assigned managed identities in Microsoft Entra ID.
You can associate as many user assigned managed identities as you want to an instance of Azure Database for PostgreSQL flexible server.
There's no support to associate user assigned managed identities to an instance of Azure Database for PostgreSQL flexible server via the portal.
Steps to remove from existing servers
The service supports dissociating user assigned managed identities which are associated to an instance of Azure Database for PostgreSQL flexible server.
An exception to that rule is any of the user assigned managed identities that are designated as the ones that should be used to access the encryption keys. This case is only possible on servers that were deployed with data encryption using customer managed keys.
There's no support to dissociate user assigned managed identities from an instance of Azure Database for PostgreSQL flexible server via the portal.
Steps to show currently assigned
Using the Azure portal:
Locate your server in the portal, if you don't have it open. One way to do it is by typing the name of the server in the search bar. When the resource with the matching name is shown, select that resource.
In the resource menu, under Overview, select JSON View.
In the Resource JSON panel that opens, find the identity property and, inside it, you can find the userAssignedIdentities. That object consists of one or more key/value pairs, where each key represents the resource identifier of one user assigned managed identity, and their corresponding value is made of principalId and clientId associated to that managed identity.
