When you use a user-assigned identity, you need to specify the client_id of the MSI in ManagedIdentityCredential().

credential = ManagedIdentityCredential(client_id="xxxxxxxx")

To get the client_id, navigate to your function app -> Identity -> User assigned -> click your user-assigned identity -> copy the client_id.

Follow below steps.

1. Enable managed identities in your host that is in a VM. Follow this documentation for more about managed identities in VM.
2. Next, give access to this managed identity to your language service. You need to assign the Cognitive Services Language Reader role to your managed identity.

3. Use the code below.

import os
from azure.core.credentials import AzureKeyCredential
from azure.ai.textanalytics import TextAnalyticsClient
from azure.identity import ManagedIdentityCredential, DefaultAzureCredential

endpoint = "https://<resource_name>.cognitiveservices.azure.com/"

sys_iden = ManagedIdentityCredential(client_id="ad7xxxxxxxfec")
text_analytics_client = TextAnalyticsClient(endpoint=endpoint, credential=sys_iden)

documents = [
    """I had the best day of my life. I decided to go sky-diving and it made me appreciate my whole life so much more.
    I developed a deep-connection with my instructor as well, and I feel as if I've made a life-long friend in her.""",
    """This was a waste of my time. All of the views on this drop are extremely boring, all I saw was grass. 0/10 would
    not recommend to any divers, even first-timers.""",
    """This was pretty good! The sights were ok, and I had fun with my instructors! Can't complain too much about my experience""",
    """I only have one word for my experience: WOW!!! I can't believe I have had such a wonderful skydiving company right
    in my backyard this whole time! I will definitely be a repeat customer, and I want to take my grandmother skydiving too,
    I know she'll love it!"""
]

result = text_analytics_client.analyze_sentiment(documents, show_opinion_mining=True)
docs = [doc for doc in result if not doc.is_error]

print("Let's visualize the sentiment of each of these documents")
for idx, doc in enumerate(docs):
    print(f"Document text: {documents[idx]}")
    print(f"Overall sentiment: {doc.sentiment}")

Here, I used ManagedIdentityCredential, which by default uses system-assigned identity, and by providing the client id, you can use user-assigned identity.

Output:

The AKS Cluster can't be linked directly with a Managed Identity, as you would do with another resource like a Virtual Machine or an Azure Function.

Within your AKS Cluster, so inside your Kubelet, you get an identity platform which is separated than your Microsoft Entra ID Identity Platform (or at least not directly connected so to say).

It does not mean you can't use your Managed Identity, but you need a step first. You must accomplish a Token Exchange between your AKS Cluster User Identity and Microsoft Entra ID. Then with the token of Entra ID, you can perform operations on Azure Control Plane.

It can be done via Workload Identity, which is practical. That means your Identity Provider of the AKS Cluster can be trusted by Entra ID to fetch tokens.

Microsoft does provide a nice tutorial for it. Since you have already your AKS Cluster up and running and a Managed Identity, you need only to:

• Update Your AKS Cluster
• Retrieve the OIDC issuer URL
• Create a variable for the managed identity's client ID
• Create a Kubernetes Service Account
• Create the federated identity credential
• Eventually redeploy

You can follow all steps here: https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster#update-an-existing-aks-cluster