add Azure Managed Identities service doc

[HarshCasper]

No description provided.

[cloudflare-workers-and-pages]

Deploying localstack-docs with    Cloudflare Pages

Latest commit:	e9d79fa
Status:	✅  Deploy successful!
Preview URL:	https://f1d1793f.localstack-docs.pages.dev
Branch Preview URL:	https://harshmishra-doc-77.localstack-docs.pages.dev

View logs

[paolosalvatori]

Hi @HarshCasper please review and integrate my comments, suggestions, and additions, thanks.

[paolosalvatori]

Suggested change

	Azure Managed Identity provides identities for Azure resources so applications can authenticate without storing credentials in code.
	It supports user-assigned identities (standalone resources) and system-assigned identities (bound to a resource lifecycle).
	Managed identities are commonly used to access Azure services securely from apps and automation workflows.
	Azure Managed Identity provides identities for Azure resources so applications can authenticate without storing credentials in code. The Azure platform supports two types of identities:
	- **System-assigned**: Tied directly to the lifecycle of a specific resource; when the resource is deleted, Azure automatically cleans up the identity.
	- **User-assigned**: Created as a standalone Azure resource that can be assigned to one or more instances, making it ideal for shared workloads and scale sets.
	Managed identities are commonly used to access Azure services securely from apps and automation workflows. For more information, see [What are managed identities for Azure resources?](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview).

[paolosalvatori]

Suggested change

	LocalStack for Azure allows you to build and test Managed Identity workflows in your local environment.
	LocalStack for Azure allows you to build and emulate applications that make use of system-assigned or user-assigned Managed Identities directly in your local environment. This enables you to validate your secret-less authentication logic with high fidelity, ensuring your code is production-ready without needing to provision live cloud resources.

[paolosalvatori]

Suggested change

	Start your LocalStack container using your preferred method.
	Then start CLI interception:
	```bash
	azlocal start_interception
	```
	Launch LocalStack using your preferred method. For more information, see [Introduction to LocalStack for Azure](/azure/getting-started/). Once the container is running, enable Azure CLI interception by running:
	```bash
	azlocal start-interception
	```
	:::note
	As an alternative to using the `azlocal` CLI, users can run:
	`azlocal start-interception`
	This command points the `az` CLI away from the public Azure management REST API and toward the LocalStack for Azure emulator API.
	To revert this configuration, run:
	`azlocal stop-interception`
	This reconfigures the `az` CLI to send commands to the official Azure management REST API.
	:::

[paolosalvatori]

Suggested change

	Create a user-assigned identity:
	Create a user-assigned managed identity:

[paolosalvatori]

Suggested change

	Get the identity:
	Get the new user-assigned managed identity:

[paolosalvatori]

Suggested change

	List identities by resource group:
	List user-assigned managed identities by resource group:

[paolosalvatori]

Suggested change

	Retrieve the system-assigned identity by scope:
	Retrieve the system-assigned managed identity by scope:

[paolosalvatori]

Suggested change

	Assign a system-managed identity to the web app:
	Enable the system-assigned managed identity on the web app

[paolosalvatori]

For consistency, since you use lower case for web app below, we need to use lower case here as well.

Suggested change

	Create an App Service plan and a Web App:
	Create an app service plan and a web app:

[paolosalvatori]

Suggested change

	```bash
	SITE_ID=$(az webapp show --name ls-app-doc77 --resource-group rg-managedidentity-demo --query id -o tsv)
	az rest --method get \
	--url "http://management.localhost.localstack.cloud:4566${SITE_ID}/providers/Microsoft.ManagedIdentity/identities/default?api-version=2024-11-30"
	```
	```bash title="Output"
	{
	"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-demo/providers/microsoft.web/sites/ls-app-doc77",
	"name": "ls-app-doc77",
	"type": "microsoft.web/sites",
	"location": "westeurope",
	"properties": {
	"principalId": "78b44418-f917-4f3a-ac29-a9821d3d8e7c",
	"clientId": "4364940c-ede7-43d8-8043-3dbad79377ee",
	"tenantId": "00000000-0000-0000-0000-000000000000",
	...
	}
	}
	```
	```bash
	az webapp identity show \
	--name ls-app-doc77 \
	--resource-group rg-managedidentity-demo
	```
	```bash title="Output"
	{
	"type": "SystemAssigned",
	"principalId": "78b44418-f917-4f3a-ac29-a9821d3d8e7c",
	"tenantId": "00000000-0000-0000-0000-000000000000",
	...
	}
	```
	You can also retrieve the system-assigned managed identity of a web app by calling the control plane REST API as follows:
	```bash
	SITE_ID=$(az webapp show --name ls-app-doc77 --resource-group rg-managedidentity-demo --query id -o tsv)
	az rest --method get \
	--url "http://management.localhost.localstack.cloud:4566${SITE_ID}/providers/Microsoft.ManagedIdentity/identities/default?api-version=2024-11-30"
	```
	```bash title="Output"
	{
	"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-demo/providers/microsoft.web/sites/ls-app-doc77",
	"name": "ls-app-doc77",
	"type": "microsoft.web/sites",
	"location": "westeurope",
	"properties": {
	"principalId": "78b44418-f917-4f3a-ac29-a9821d3d8e7c",
	"clientId": "4364940c-ede7-43d8-8043-3dbad79377ee",
	"tenantId": "00000000-0000-0000-0000-000000000000",
	...
	}
	}
	```
	## Features
	The Managed Identity emulator supports the following features:
	- **User-assigned identity lifecycle**: Full create, read, update, and delete operations for user-assigned managed identities, including tag management and cross-region relocation.
	- **System-assigned identity retrieval**: Retrieve the system-assigned identity of any resource by scope, returning the associated principal ID, client ID, and tenant ID.
	- **Service principal auto-provisioning**: When a managed identity is created, a corresponding service principal is automatically registered in the Microsoft Graph store, mirroring Azure's built-in identity-to-directory integration.
	- **Role assignments**: Create, retrieve, delete, and list role assignments at subscription and scope levels. Scope-based filtering matches assignments by resource hierarchy.
	- **Role definitions**: Create and manage custom role definitions with granular permissions and assignable scopes. Over 549 builtin Azure role definitions are preloaded and available for immediate use.
	- **Management locks**: Create, delete, retrieve, and list management locks at the resource group level. Supported lock levels are `CanNotDelete` and `ReadOnly`.
	- **Microsoft Graph service principal queries**: List, create, and delete service principals through the Microsoft Graph `/v1.0/servicePrincipals` endpoint with OData query support including `$filter`, `$select`, `$top`, `$count`, and `$orderby`.
	- **Directory object lookups**: Resolve multiple directory objects by ID through the `/v1.0/directoryObjects/getByIds` endpoint.
	## Limitations
	The Managed Identity emulator has the following limitations:
	- **Federated identity credentials**: Federated identity credential operations (create, get, delete, list) are not yet implemented.
	- **No token issuance**: The emulator does not issue actual OAuth 2.0 tokens or enforce authentication. Identity objects are created and stored, but no real credential exchange occurs.
	- **Management locks scope**: Management locks are supported only at the resource group level. Subscription-level and individual-resource-level locks are not implemented.
	- **Microsoft Graph pagination**: The `@odata.nextLink` pagination mechanism is not implemented. Large result sets are returned in a single response.
	- **No data persistence across restarts**: Identity, role assignment, role definition, and service principal data is held in memory and is lost when the emulator is stopped or restarted.
	## Samples
	The following samples demonstrate how to use Managed Identity with LocalStack for Azure:
	- [Azure Functions App with Managed Identity](https://github.com/localstack/localstack-azure-samples/tree/main/samples/function-app-managed-identity/python)
	- [Azure Web App with Managed Identity](https://github.com/localstack/localstack-azure-samples/tree/main/samples/web-app-managed-identity/python)