Ok, I solved it using the cdp cli.   The problem was that from web ui of Cloudera Management Console it is not possible to insert the identity for ranger, while from cli it is possible. Below are the scripts for creating the data lake environment: cdp environments create-azure-environment \ --environment-name <ENV_NAME> \ --credential-name <CREDENTIAL_NAME> \ --region "AZURE_REGIONE_NAME" \ --security-access cidr=0.0.0.0/0 \ --no-enable-tunnel \ --public-key "ssh-rsa ..." \ --log-storage storageLocationBase=abfs://logs@<STORAGE_ACCOUNT_NAME>.dfs.core.windows.net,managedIdentity=/subscriptions/xxx/resourcegroups/<RG_NAME>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<ENV_NAME>-LoggerIdentity \ --use-public-ip \ --existing-network-params networkId=<ENV_NAME>-Vnet,resourceGroupName=<ENV_NAME>,subnetIds=CDP \ --free-ipa instanceCountByGroup=1 cdp environments set-id-broker-mappings \ --environment-name <ENV_NAME> \ --data-access-role /subscriptions/xxx/resourceGroups/<RG_NAME>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<ENV_NAME>-DataAccessIdentity \ --ranger-audit-role /subscriptions/xxx/resourceGroups/<RG_NAME>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<ENV_NAME>-RangerIdentity \ --set-empty-mappings cdp datalake create-azure-datalake \ --datalake-name <ENV_NAME> \ --environment-name <ENV_NAME> \ --cloud-provider-configuration managedIdentity=/subscriptions/xxx/resourcegroups/<RG_NAME>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<ENV_NAME>-AssumerIdentity,storageLocation=abfs://data@<STORAGE_ACCOUNT_NAME>.dfs.core.windows.net \ --scale LIGHT_DUTY \ --runtime 7.2.7 Here instead the dockerfile for those wishing to have the cdp-cli in cointainer: FROM python RUN apt update \ && apt upgrade -y \ && apt install -y \ groff \ less RUN git clone https://github.com/cloudera/cdpcli.git \ && cd cdpcli \ && pip install .   ... View more