You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.

In Azure, enabling a system-assigned managed identity on a virtual machine is done on the VM resource itself. With the Az PowerShell module, you first retrieve the VM object and then update it to enable the identity. The correct sequence is to call Get-AzVM to load VM1 into a variable and then Update-AzVM -IdentityType SystemAssigned to turn on the built-in identity for that VM. After the identity is enabled, Azure AD automatically creates a service principal that represents the VM’s managed identity. To add this identity to an Azure AD security group (Group1), you must reference that service principal. The Az.Resources cmdlet Get-AzADServicePrincipal -DisplayName "vm1" returns the service principal object for the VM’s system-assigned identity. You then look up the target group with Get-AzADGroup and add the service principal as a member using Add-AzureADGroupMember, passing the group’s ObjectId and the service principal’s Id. This aligns with Microsoft guidance that VM system-assigned identities are represented in Entra ID as service principals, and that group membership operations use the service principal’s object id when adding an application/managed identity to a group.

Filled script:

$vm = Get-AzVM -ResourceGroupName myResourceGroup -Name vm1

Update-AzVM -ResourceGroupName myResourceGroup -VM $vm -IdentityType SystemAssigned

$displayname = Get-AzADServicePrincipal -DisplayName "vm1"

$group = Get-AzADGroup -SearchString "group1"

Add-AzureADGroupMember -ObjectId $group.Id -RefObjectId $displayname.Id