Authenticate to SQL Server with Azure app service managed identity through group

We have a Azure VM with SQL Server, and we also have an app service web application.

The app service has a managed identity since we toggled this on:

Now I want to authenticate this app service to SQL Server.

I can successfully do this by creating a SQL Server identity mapping to the managed identity itself.

Like this:

CREATE LOGIN [my-app-service] 
FROM EXTERNAL PROVIDER;

and then give it database permissions.

The issue is that I don't see this very scalable. We have several applications that will require database access. Hence my plan is to create a group in Entra and add the managed identity to this group.

Working with regular users (developers) I have successfully achieved this.

For example in Entra:

And then in SQL Server:

CREATE LOGIN [Developers - internal] 
FROM EXTERNAL PROVIDER;

and adding database permissions and so forth.

When trying to achieve this with managed identity I'm unsuccessful.

I have added the service principal to my group, but this doesn't work.

I have some suspicion that adding the managed identity as a regular member is not the correct thing to do. There is also a section called applications.

I'm able to add other enterprise applications to a group but when I navigate into my managed identity the button to add it to a group is disabled. I've also added all permissions I can think of (Cloud Application Administrator, Application Administrator according to this). Still can't make it to work.

Anyone know how to achieve the root issue? Authenticate to SQL server with managed identity through a group, not the identity itself?

Anyone know if it is possible to enable that "Add user/group"-button?

I've had that work way in the past at least with direct membership. Just having the service principal in group was enough.

You might also need to wait for some time (more than a day in worst case) for changes to apply to tokens.

This seems to have worked in this case. I'm not 100% sure how Azure SQL checks group memberships but I assume there is some kind of cache that requires waiting in order for changes to apply.