title: Azure Keyvault add Function MSI via ARM
body: <p>I think Managed Service Identity is a great concept and I love keyvault. However:</p>
  
  <p>When I use the script using an incremental resource group deployment:</p>
  
  <p><em>Sample is modified for brevity</em></p>
  
  <pre><code>{
        "type": "Microsoft.KeyVault/vaults",
        "name": "[parameters('keyvaultName')]",
        "apiVersion": "2015-06-01",
        "properties": {            
          "accessPolicies": [
            {
              "objectId": "[reference(parameters('functionAppName'), '2016-08-01', 'Full').identity.principalId]",
              "permissions": {
                "keys": [],
                "secrets": [
                  "Get"
                ]
              }
            }
          ]
        },
        "dependsOn": [
          "[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]"
        ]
      },
      {
        "apiVersion": "2016-08-01",
        "type": "Microsoft.Web/sites",
        "name": "[parameters('functionAppName')]",
        "kind": "functionapp",
        "identity": {
          "type": "SystemAssigned"
        },
      }
  </code></pre>
  
  <p>It deploys successfully and adds the MSI to keyvault, but --</p>
  
  <p>It blows away the already assigned access policies. Is it possible for arm to preserve accessPolicies and only add/update policies that match?</p>
  
  <p>Without this it's impossible to fully script a deployment with a MSI and also assign the principal to keyvault.. </p>
  
  <p>Am I missing something?</p>