I’m creating infrastructure in Azure using BICEP for our enterprise application. Our application uses key vaults to store and recall secrets using a service principal (application).

When I create the KV in BICEP and associate the service principal with it, it is created as a compound identity in the KV access policies. I need it to added as a ‘application’, which is what happens when I add it manually via the Azure Portal.

How can I add my service principal as an application and not a compound identity?

resource accessPolicydev 'Microsoft.KeyVault/vaults/accessPolicies@2023-07-01' = {
  parent: keyvaultExisting
  name: 'add'
  properties: {
    accessPolicies: [
      {
        tenantId: tenantId
        objectId: objectId
        applicationId: applicationId
        permissions: {
          secrets: [
            'all'
          ]
          certificates: [
            'all'
          ]
          keys: [
            'all'
          ]
        }        
      }    
    ]
  }
}