Understanding limit of 20 federated identity credentials per managed identity

[dkirrane]

I'm trying to better understand the 20 federated identity credentials per managed identity.

Does this mean that re-using the same Microsoft Entra ID application across many AKS clusters would be a problem?

We plan to script it so we create an app, serviceaccount & federated Identity per Kubernetes Deployment/StatefulSet. We have many AKS clusters 50+

azwi serviceaccount create phase app \
         my-service-1

azwi serviceaccount create phase sa \
         my-service-1

azwi serviceaccount create phase fi \
         --aad-application-name my-service-1 \
         --service-account-name my-service-1

It sounds like we can do this for at most 20 AKS clusters if the app is same name across clusters??

If so I guess we can suffix the app name e.g. my-service-1-dev, my-service-qa, my-service-prod-na etc...
Would this be the recommendation to workaround this limitation?

[abymsft]

I am too looking for an answer.
@aramase will you be able help?