azurerm_user_assigned_identity cost estimation
A user-assigned managed identity is free. Creating a standalone identity and attaching it to resources costs nothing. It removes credentials, not charges.
An azurerm_user_assigned_identity is a standalone managed identity you create once and attach to one or more Azure resources, such as VMs, container apps, or function apps. The identity is free. Azure does not charge for creating it, for the Microsoft Entra ID service principal it registers, or for the number of resources it is assigned to.
A managed identity has no cost of its own; its purpose is to let a workload authenticate to Azure services without embedded secrets. It becomes useful only when paired with role assignments that grant it access to resources like Key Vault, Storage, or SQL. Those target resources are billed, and the operations the identity performs (reading secrets, writing blobs) may count toward the target's transaction or operation meters, but the identity itself never appears on the bill. Compared to a user-assigned identity, a system-assigned identity is tied to a single resource's lifecycle; the user-assigned variant is reusable, which is an operational choice, not a cost one.
There is nothing to optimize on the identity. The value is that it replaces stored keys and connection strings with token-based access, a security improvement at no charge. c3x prices the Key Vaults, storage accounts, and databases an identity is granted access to and treats the identity as free.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "azurerm_resource_group" "main" {
name = "app-prod-rg"
location = "eastus"
}
resource "azurerm_user_assigned_identity" "app" {
name = "app-identity"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
}Pricing dimensions
What you actually pay for when you provision azurerm_user_assigned_identity.
| Dimension | Unit | What's being charged |
|---|---|---|
| Managed identity | free | The identity, its Entra ID registration, and the resources it attaches to have no charge. $0 |
| Operations against target resources | varies (billed elsewhere) | Reads and writes the identity performs are metered on the target, such as Key Vault operations or storage transactions. |
Optimization tips
Common ways to reduce azurerm_user_assigned_identity cost without changing the workload.
Reuse one identity across resources
A user-assigned identity can be attached to many resources. Reusing one identity for a workload's components simplifies role management, though it does not change cost since the identity is free.
Replace stored keys with identity access
Granting an identity a data-plane role removes connection strings and account keys from configuration, a security win with no billing impact.
Batch Key Vault reads to control target cost
An identity that reads secrets does not cost anything, but each read counts toward Key Vault operation billing. Caching and batching reduce those metered operations on the vault.
FAQ
Does an Azure managed identity cost money?
No. User-assigned and system-assigned managed identities are free, including the underlying Entra ID registration. You pay only for the resources the identity is granted access to.
Is there a charge per resource an identity is attached to?
No. Attaching a user-assigned identity to any number of VMs, function apps, or container apps is free. The identity carries no per-attachment fee.
Can a managed identity increase my Key Vault bill?
Indirectly. The identity is free, but the secret and key operations it performs count toward Key Vault operation billing on the vault. Caching reads keeps those operations down.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including azurerm_user_assigned_identity.