You have an Azure subscription named Sub1 that contains a virtual machine named VM1.

When enabling Microsoft Entra (Azure AD) login for a virtual machine, you must assign a managed identity so that the VM can authenticate to Azure AD and access other Azure resources securely without storing credentials.

Between the two types of managed identities— system-assigned and user-assigned —the system-assigned identity is the most appropriate when the identity is unique to the VM and should be automatically managed by Azure.

Once you enable a system-assigned managed identity , Azure creates an identity tied directly to the VM’s lifecycle. It allows the VM to request tokens from Microsoft Entra ID and access resources within Sub1 under the permissions granted through RBAC.

From Microsoft documentation:

“To enable Microsoft Entra login for your VM, the VM must have a system-assigned managed identity that is granted access to Azure resources.”