Which one to use with my API App, is it Managed Identity or Azure AD Service Principal

Question

I have an API App that i created and i would like to grant the API App access to my Azure Blob Storage Account and assign the required RBAC permissions to the API App to the Blob Storage Account. Let's say i want to give "Storage Account Contributor" access to my API app to the Blob Storage Account. There will be other APIs that will consume my API App to perform operations on the Blob Storage Account. So i would like to know whether i can use a System Assigned Managed Identity and assign that System Assigned Managed Identity to my API App and then provide the Sys Assigned Identity the "Storage Contributor " RBAC access to my Blob Storage Account, is this possible? Or i have to register my App first in Azure AD, generate a SP and then assign RBAC permissions to the SP ?

At the moment i don't see any option as to how i can assign a Managed Identity to my API App, like you see in Azure Resources when you go to Settings of the resource, you see an identity section

Answer 1

You can use MSI(Managed Identity) directly, to assign a Managed Identity to the API App, just navigate to the API App in the portal -> Identity -> enable it like below.

Reference - https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=dotnet#using-the-azure-portal