Problem Adding Access Policy for KeyVault - two principals?

[dazinator]

I deployed via the ARM template.
I'm just on the last step of adding an access policy to keyvault for certificate management.
When searching for the principal, there are two possible candidates:

Is this a bug? How do I know which one to use?

It's a bit odd to me because I can only see one function app in the resource group, yet on the ARM deployment I can see two "sites" were created:

[dazinator]

In terms of working out which prinicpal is the correct one, I think the following works:

1. Go into the function app, click oon "Identity" tab and get the "Object Id"

   

2. When creting the access policy in key vault, on the prinipal search UI, search for the object id.

   

It seems to return only of the principals so I am assuming this is correct one.
As to why there are two, I am not sure.

[shibayan]

I just tried deploying from ARM Template, but I couldn't reproduce it. The principal creation is done inside Azure, so it is most likely a bug on the Azure side.

The way to check the correct Principal is as you wrote.

[dazinator]

Ok, thanks.

[rvdwegen]

I ran into the same thing and in my case one of them was an app registration in AzureAD