Would I have to give the user assigned identity Network Contributor access myself to the underlying VM network that gets created? That was mentioned somewhere in the docs...

I've been at this for a day or so now - and I'm not progressing so well. I've applied my user assigned managed identity into the dictionary, the pulumi up runs - but the scale set doesn't associate with the identity. No error being thrown either. My approach has been to pass in the full ID of the managed identity (/subscriptions/xxxx/.../providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>).

var identityArgsValue = new ManagedClusterIdentityArgs()
{
    Type = ResourceIdentityType.SystemAssigned
};

if (userAssignedManagedIdent != null)
{
    identityArgsValue = new ManagedClusterIdentityArgs()
    {
        Type = ResourceIdentityType.UserAssigned,
        UserAssignedIdentities = userAssignedManagedIdent.Apply(id =>
        {
            var im = new Dictionary<string, object>()
            {
                {
                    id, new Dictionary<string, object>()
                } 
            };

            return im;
        })
    };
}

Any ideas why this wouldn't take?

For anyone interested in the future - I succeeded with this