Merge pull request #292574 from zhiyuanliang-ms/zhiyuanliang/update-cmk

Azure App Configuration - Add guidance for using user-assigned identity

Author: prmerger-automator[bot]

articles/azure-app-configuration/concept-customer-managed-keys.md

@@ -78,6 +78,9 @@ After these resources are configured, use the following steps so that the Azure
     }
     ```
 
+    > [!NOTE]
+    > To create a user-assigned managed identity, follow this [tutorial](./overview-managed-identity.md#adding-a-user-assigned-identity).
+
 1. The managed identity of the Azure App Configuration instance needs access to the key to perform key validation, encryption, and decryption. The specific set of actions to which it needs access includes: `GET`, `WRAP`, and `UNWRAP` for keys. These permissions can be granted by assigning the `Key Vault Crypto Service Encryption User` role for Azure RBAC enabled Key Vaults. For Key Vaults using access policy authorization, set the policy for the aforementioned key permissions. Granting access requires the principal ID of the App Configuration instance's managed identity. Replace the value shown below as `contoso-principalId` with the principal ID obtained in the previous step. Grant permission to the managed key by using the command line:
 
     ### [Azure RBAC](#tab/azurerbac)
@@ -102,6 +105,11 @@ After these resources are configured, use the following steps so that the Azure
     az appconfig update -g contoso-resource-group -n contoso-app-config --encryption-key-name key-name --encryption-key-version key-version --encryption-key-vault key-vault-Uri
     ```
 
+    The command uses system-assigned managed identity to authenticate with the key vault by default. 
+
+    > [!NOTE]
+    > When using a user-assigned managed identity to access the customer managed key, you can specify its client ID explicitly by adding `--identity-client-id <client ID of your user assigned identity>` to the command.
+
 Your Azure App Configuration instance is now configured to use a customer-managed key stored in Azure Key Vault.
 
 ## Next Steps