diff --git a/ziti/cmd/edge/create_identity.go b/ziti/cmd/edge/create_identity.go
index 7283c1466..e50ecab28 100644
--- a/ziti/cmd/edge/create_identity.go
+++ b/ziti/cmd/edge/create_identity.go
@@ -43,6 +43,7 @@ type createIdentityOptions struct {
 	servicePrecedences       map[string]string
 	appData                  map[string]string
 	externalId               string
+	authPolicyNameOrId       string
 }
 
 // newCreateIdentityCmd creates the 'edge controller create identity' command
@@ -93,6 +94,7 @@ func newCreateIdentityOfTypeCmd(idType string, options *createIdentityOptions) *
 	cmd.Flags().StringToIntVar(&options.serviceCosts, "service-costs", map[string]int{}, "Per-service hosting costs")
 	cmd.Flags().StringToStringVar(&options.servicePrecedences, "service-precedences", map[string]string{}, "Per-service hosting precedences")
 	cmd.Flags().StringToStringVar(&options.appData, "app-data", nil, "Custom application data")
+	cmd.Flags().StringVarP(&options.authPolicyNameOrId, "auth-policy", "P", "default", "The name or id of the auth policy to assign to the identity")
 
 	options.AddCommonFlags(cmd)
 
@@ -156,7 +158,21 @@ func runCreateIdentity(idType string, o *createIdentityOptions) error {
 		delete(o.servicePrecedences, k)
 		o.servicePrecedences[id] = prec
 	}
+
 	api.SetJSONValue(entityData, o.servicePrecedences, "serviceHostingPrecedences")
+
+	authPolicyId, err := mapNameToID("auth-policies", o.authPolicyNameOrId, o.Options)
+
+	if err != nil {
+		return fmt.Errorf("could not fetch auth policy by name or id: %w", err)
+	}
+
+	if authPolicyId == "" {
+		return fmt.Errorf("authentication policy id or name '%s' is not found", o.authPolicyNameOrId)
+	}
+
+	api.SetJSONValue(entityData, authPolicyId, "authPolicyId")
+
 	o.SetTags(entityData)
 
 	result, err := CreateEntityOfType("identities", entityData.String(), &o.Options)
diff --git a/ziti/cmd/edge/list.go b/ziti/cmd/edge/list.go
index 7b2f6feca..9c8767f90 100644
--- a/ziti/cmd/edge/list.go
+++ b/ziti/cmd/edge/list.go
@@ -979,7 +979,7 @@ func outputIdentities(o *api.Options, children []*gabs.Container, pagingInfo *ap
 
 	t := table.NewWriter()
 	t.SetStyle(table.StyleRounded)
-	t.AppendHeader(table.Row{"ID", "Name", "Type", "Attributes"})
+	t.AppendHeader(table.Row{"ID", "Name", "Type", "Attributes", "Auth-Policy"})
 
 	for _, entity := range children {
 		wrapper := api.Wrap(entity)
@@ -987,7 +987,8 @@ func outputIdentities(o *api.Options, children []*gabs.Container, pagingInfo *ap
 			wrapper.String("id"),
 			wrapper.String("name"),
 			wrapper.String("type.name"),
-			strings.Join(wrapper.StringSlice("roleAttributes"), ",")})
+			strings.Join(wrapper.StringSlice("roleAttributes"), ","),
+			wrapper.String("authPolicyId")})
 	}
 	api.RenderTable(o, t, pagingInfo)
 
diff --git a/ziti/cmd/edge/update_identity.go b/ziti/cmd/edge/update_identity.go
index 820294d63..4cdcae87f 100644
--- a/ziti/cmd/edge/update_identity.go
+++ b/ziti/cmd/edge/update_identity.go
@@ -41,6 +41,7 @@ type updateIdentityOptions struct {
 	servicePrecedences       map[string]string
 	appData                  map[string]string
 	externalId               string
+	authPolicyIdOrName       string
 }
 
 func newUpdateIdentityCmd(out io.Writer, errOut io.Writer) *cobra.Command {
@@ -74,6 +75,7 @@ func newUpdateIdentityCmd(out io.Writer, errOut io.Writer) *cobra.Command {
 	cmd.Flags().StringToIntVar(&options.serviceCosts, "service-costs", map[string]int{}, "Per-service hosting costs")
 	cmd.Flags().StringToStringVar(&options.servicePrecedences, "service-precedences", map[string]string{}, "Per-service hosting precedences")
 	cmd.Flags().StringToStringVar(&options.appData, "app-data", nil, "Custom application data")
+	cmd.Flags().StringVarP(&options.authPolicyIdOrName, "auth-policy", "P", "", "The auth policy id or name to assign to the identity")
 
 	return cmd
 }
@@ -116,6 +118,19 @@ func runUpdateIdentity(o *updateIdentityOptions) error {
 		change = true
 	}
 
+	if o.Cmd.Flags().Changed("auth-policy") {
+		authPolicyId, err := mapNameToID("auth-policies", o.authPolicyIdOrName, o.Options)
+		if err != nil {
+			return fmt.Errorf("could not fetch auth policy by name or id: %w", err)
+		}
+
+		if authPolicyId == "" {
+			return fmt.Errorf("authentication policy id or name '%s' is not found", o.authPolicyIdOrName)
+		}
+		api.SetJSONValue(entityData, authPolicyId, "authPolicyId")
+		change = true
+	}
+
 	if o.Cmd.Flags().Changed("service-costs") {
 		for k, v := range o.serviceCosts {
 			if v < 0 || v > math.MaxUint16 {