The documentation for using an Azure Storage account says that I have to set either AZURE_STORAGE_KEY or AZURE_STORAGE_SAS_TOKEN. However, it says for additonal options see Azure Setup. https://www.pulumi.com/registry/packages/azure/installation-configuration/ I have tried (with no success) to utilize the CLI / Managed Identity setup to authenticate with the storage account WITHOUT using a SAS token / Storage key. Am I wrong in assuming that the RBAC setup for my User (CLI) / Managed Identity should be sufficient? Assuming that i hold the respective role on the storage account?

Yeah, off the top of my head, you don't have to set them if you have MSI or CLI auth configured. You can see the resolution order here: https://github.com/google/go-cloud/blob/0a37d2f8da8a73844216841be73381c92438d7e8/blob/azureblob/azureblob.go#L27