# Steps to be Performed by Customer Account

**Step 1: Create a User-Assigned Managed Identity**

1. Navigate to the Azure Portal.
2. Search for **Managed Identities** and select it.
3. Click **+ Create**
4. Choose your **Subscription** and **Resource Group**.
5. Enter a **Name** (e.g., customer).
6. Select the **Region**.
7. Click **Review + Create**, then **Create**.

<figure><img src="https://3484040590-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeVBYKZm1xFKFFVzS0lRJ%2Fuploads%2F4BCInfVfaPnBeiA0eGwP%2FScreenshot%202025-08-21%20at%205.17.51%E2%80%AFPM.png?alt=media&#x26;token=d196b73d-925b-40d2-a1b5-758e13d1b764" alt=""><figcaption></figcaption></figure>

#### Step 2: Add Federated Credentials

1. Open the newly created Managed Identity.

<figure><img src="https://3484040590-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeVBYKZm1xFKFFVzS0lRJ%2Fuploads%2FCM7CK2WxXLLTvi4KGT7j%2FScreenshot%202025-08-21%20at%205.17.16%E2%80%AFPM.png?alt=media&#x26;token=5bf53cc4-21ee-4fca-b28f-d5f9ac955768" alt=""><figcaption></figcaption></figure>

2. In the left menu, click **Federated credentials**.
3. Click **+ Add credential**.
4. In **Federated credential scenario**, select **Kubernetes accessing Azure resources**.
5. Enter the following details:
   * **Cluster Issuer URL**: (based on your AKS cluster configuration)
   * **Namespace**: \<namespace>
   * **Service Account**: \<service-account>
6. Click **Add**.

<figure><img src="https://3484040590-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FeVBYKZm1xFKFFVzS0lRJ%2Fuploads%2FGNfRxPTMwAwn71nru3t4%2FScreenshot%202025-08-21%20at%205.16.43%E2%80%AFPM.png?alt=media&#x26;token=1681d547-2f1e-45c8-bf72-0d497508f2df" alt=""><figcaption></figcaption></figure>

#### Step 3: Assign Role-Based Access Control (RBAC) Permissions

1. Open the Managed Identity.
2. In the left menu, click **Access control (IAM)**.
3. Click **+ Add role assignment**.
4. Assign the following role(s):
   * **Storage Blob Data Reader** (read-only access)
5. Click **Next**, then select **Managed Identity** as the principal type.
6. Search for your identity (e.g., customer) and select it.
7. Click **Review + Assign**.

#### Step 4: Retrieve Identity Information

1. Open the Managed Identity.
2. From the **Overview** page, note down:
   * **Client ID**
   * **Principal ID**
3. These values will be used by e6data in Kubernetes and Azure services for secure authentication.

#### Step 5: Deploy in Serverless Account

After configuring the Managed Identity and role assignments, you can now deploy a Kubernetes pod in the **Serverless Account** to access storage in the **Customer Account**.

{% hint style="info" %}
**Note:** All these steps can also be performed via an **ARM template**.
{% endhint %}