diff --git a/pkg/apis/acme/v1/types_issuer.go b/pkg/apis/acme/v1/types_issuer.go
index 52dd948cc..5006c1839 100644
--- a/pkg/apis/acme/v1/types_issuer.go
+++ b/pkg/apis/acme/v1/types_issuer.go
@@ -500,11 +500,11 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
 	// +optional
 	Environment AzureDNSEnvironment `json:"environment,omitempty"`
 
-	// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityResourceID)
+	// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityResourceID)
 	// +optional
 	ManagedIdentityClientID string `json:"managedIdentityClientID,omitempty"`
 
-	// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityClientID)
+	// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityClientID)
 	// +optional
 	ManagedIdentityResourceID string `json:"managedIdentityResourceID,omitempty"`
 }
diff --git a/pkg/apis/acme/v1alpha2/types_issuer.go b/pkg/apis/acme/v1alpha2/types_issuer.go
index 8f3868cf7..8788a9cfd 100644
--- a/pkg/apis/acme/v1alpha2/types_issuer.go
+++ b/pkg/apis/acme/v1alpha2/types_issuer.go
@@ -497,11 +497,11 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
 	// +optional
 	Environment AzureDNSEnvironment `json:"environment,omitempty"`
 
-	// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityResourceID)
+	// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityResourceID)
 	// +optional
 	ManagedIdentityClientID string `json:"managedIdentityClientID,omitempty"`
 
-	// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityClientID)
+	// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityClientID)
 	// +optional
 	ManagedIdentityResourceID string `json:"managedIdentityResourceID,omitempty"`
 }
diff --git a/pkg/apis/acme/v1alpha3/types_issuer.go b/pkg/apis/acme/v1alpha3/types_issuer.go
index 7c9c17bd8..e561ef3ab 100644
--- a/pkg/apis/acme/v1alpha3/types_issuer.go
+++ b/pkg/apis/acme/v1alpha3/types_issuer.go
@@ -497,11 +497,11 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
 	// +optional
 	Environment AzureDNSEnvironment `json:"environment,omitempty"`
 
-	// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityResourceID)
+	// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityResourceID)
 	// +optional
 	ManagedIdentityClientID string `json:"managedIdentityClientID,omitempty"`
 
-	// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityClientID)
+	// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityClientID)
 	// +optional
 	ManagedIdentityResourceID string `json:"managedIdentityResourceID,omitempty"`
 }
diff --git a/pkg/apis/acme/v1beta1/types_issuer.go b/pkg/apis/acme/v1beta1/types_issuer.go
index 1f08a3b8d..53ab5bd54 100644
--- a/pkg/apis/acme/v1beta1/types_issuer.go
+++ b/pkg/apis/acme/v1beta1/types_issuer.go
@@ -496,11 +496,11 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
 	// +optional
 	Environment AzureDNSEnvironment `json:"environment,omitempty"`
 
-	// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityResourceID)
+	// clientID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityResourceID)
 	// +optional
 	ManagedIdentityClientID string `json:"managedIdentityClientID,omitempty"`
 
-	// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time with ManagedIdentityClientID)
+	// resourceID of the MSI that should be used (only relevant when using MSI, can not be used at the same time as ManagedIdentityClientID)
 	// +optional
 	ManagedIdentityResourceID string `json:"managedIdentityResourceID,omitempty"`
 }
diff --git a/pkg/internal/apis/acme/types_issuer.go b/pkg/internal/apis/acme/types_issuer.go
index dfdc91340..7076bed57 100644
--- a/pkg/internal/apis/acme/types_issuer.go
+++ b/pkg/internal/apis/acme/types_issuer.go
@@ -427,6 +427,10 @@ type ACMEIssuerDNS01ProviderAzureDNS struct {
 	HostedZoneName string
 
 	Environment AzureDNSEnvironment
+
+	ManagedIdentityClientID string
+
+	ManagedIdentityResourceID string
 }
 
 type AzureDNSEnvironment string
diff --git a/pkg/internal/apis/certmanager/validation/issuer.go b/pkg/internal/apis/certmanager/validation/issuer.go
index 042400229..96d55408e 100644
--- a/pkg/internal/apis/certmanager/validation/issuer.go
+++ b/pkg/internal/apis/certmanager/validation/issuer.go
@@ -335,6 +335,18 @@ func ValidateACMEChallengeSolverDNS01(p *cmacme.ACMEChallengeSolverDNS01, fldPat
 				if len(p.AzureDNS.TenantID) == 0 {
 					el = append(el, field.Required(fldPath.Child("azureDNS", "tenantID"), ""))
 				}
+				if len(p.AzureDNS.ManagedIdentityClientID) > 0 {
+					el = append(el, field.Forbidden(fldPath.Child("azureDNS", "managedIdentityClientID"), "managed identity can not be used at the same time as clientID, tenantID or clientSecret"))
+				}
+				if len(p.AzureDNS.ManagedIdentityResourceID) > 0 {
+					el = append(el, field.Forbidden(fldPath.Child("azureDNS", "managedIdentityResourceID"), "managed identity can not be used at the same time as clientID, tenantID or clientSecret"))
+				}
+			} else {
+				// using managed identity
+				if len(p.AzureDNS.ManagedIdentityClientID) > 0 && len(p.AzureDNS.ManagedIdentityResourceID) > 0 {
+					el = append(el, field.Forbidden(fldPath.Child("azureDNS"), "managedIdentityClientID and managedIdentityResourceID connot both be specified"))
+				}
+
 			}
 			// SubscriptionID must always be defined
 			if len(p.AzureDNS.SubscriptionID) == 0 {
diff --git a/pkg/issuer/acme/dns/azuredns/azuredns.go b/pkg/issuer/acme/dns/azuredns/azuredns.go
index f543c37d5..a65de26ea 100644
--- a/pkg/issuer/acme/dns/azuredns/azuredns.go
+++ b/pkg/issuer/acme/dns/azuredns/azuredns.go
@@ -49,10 +49,6 @@ func NewDNSProviderCredentials(environment, clientID, clientSecret, subscription
 		}
 	}
 
-	if managedIdentityClientID != "" && managedIdentityResourceID != "" {
-		return nil, fmt.Errorf("managedIdentityClientID and managedIdentityResourceID can not be set at the same time")
-	}
-
 	spt, err := getAuthorization(env, clientID, clientSecret, subscriptionID, tenantID, ambient, managedIdentityClientID, managedIdentityResourceID)
 	if err != nil {
 		return nil, err