The trick to make it work is by authorizations parameter in az managedapp definition create. I need to use a user or service principle with the same role and group defined in authorizations parameter. I used service princpiple to login in my CI/CD workflow.