It seems that the ManagedServiceIdentityArgs object for App Gateway is an InputMap that expects the key to be the ID of the managed identity, which needs to be a string. As you might expect, I want to create the Managed Identity using Pulumi so the ID is Output<string>, is there any way to get this into App Gateway without having to wrap the entire App GW object in an apply statement? I really don't want to do that as the Managed Identity is an optional setting, so I'd have to have two full copies of all the app gw code.

You should be able to produce the dictionary (inputmap) inside an

apply

.

yep, that'll do it, thanks!