How to use managed identity to access key vault on different subscription of same tenant?

Question

Have my Azure VM scale set on subscription1 of tenantA & assigned user managed identity which also belongs to subscription1 of tenantA.

Now I have keyvault on subscription2 of tenantA(same tenant). The keyvault hold secrets which the apps on Azure VM scale set on subscription1 needs to access.

It is possible to add managed identity Azure VM scale set on subscription1 to the access policy of the keyvault on subscription2 of same tenant as per the below answer.

Is it possible to add managed identity Azure VM scale set on subscription1 to the access policy of the keyvault on subscription2 of different directory/tenant?

Answer 1

Yes. A Managed Identity creates a service principal in the Azure AD tenant of its subscription. That service principal can be granted access to anything within that Azure AD tenant, including all subscriptions linked to it.