diff --git a/pipelines/types/pipeline.schema.v1.json b/pipelines/types/pipeline.schema.v1.json
index 3569cb2..cc6af36 100644
--- a/pipelines/types/pipeline.schema.v1.json
+++ b/pipelines/types/pipeline.schema.v1.json
@@ -451,7 +451,8 @@
         }
       },
       "required": [
-        "command"
+        "command",
+        "shellIdentity"
       ]
     },
     "shellStep": {
diff --git a/pipelines/types/pipeline_test.go b/pipelines/types/pipeline_test.go
index 057c47a..81c012c 100644
--- a/pipelines/types/pipeline_test.go
+++ b/pipelines/types/pipeline_test.go
@@ -79,6 +79,8 @@ resourceGroups:
   - name: deploy
     action: Shell
     command: echo hello
+    shellIdentity:
+      value: existing-msi
 `,
 			expectError: false,
 			description: "backfillSubscriptionId alone should be valid",
@@ -101,6 +103,8 @@ resourceGroups:
   - name: deploy
     action: Shell
     command: echo hello
+    shellIdentity:
+      value: existing-msi
 `,
 			expectError: false,
 			description: "displayName and roleAssignment alone should be valid",
@@ -124,6 +128,8 @@ resourceGroups:
   - name: deploy
     action: Shell
     command: echo hello
+    shellIdentity:
+      value: existing-msi
 `,
 			expectError: false,
 			description: "backfillSubscriptionId with displayName should be valid (new behavior)",
@@ -152,6 +158,8 @@ resourceGroups:
   - name: deploy
     action: Shell
     command: echo hello
+    shellIdentity:
+      value: existing-msi
 `,
 			expectError: false,
 			description: "backfillSubscriptionId with all other fields should be valid (new behavior)",
@@ -173,6 +181,8 @@ resourceGroups:
   - name: deploy
     action: Shell
     command: echo hello
+    shellIdentity:
+      value: existing-msi
 `,
 			expectError: true,
 			description: "missing both required patterns should fail validation",
@@ -194,6 +204,8 @@ resourceGroups:
   - name: deploy
     action: Shell
     command: echo hello
+    shellIdentity:
+      value: existing-msi
 `,
 			expectError: true,
 			description: "displayName without roleAssignment should fail validation",
diff --git a/pipelines/types/validation_test.go b/pipelines/types/validation_test.go
index b860c69..4ac6a20 100644
--- a/pipelines/types/validation_test.go
+++ b/pipelines/types/validation_test.go
@@ -303,6 +303,9 @@ func TestValidatePipelineSchema(t *testing.T) {
 								"name":    "step",
 								"action":  "Shell",
 								"command": "echo hello",
+								"shellIdentity": map[string]interface{}{
+									"value": "test-msi",
+								},
 							},
 						},
 					},
@@ -325,6 +328,9 @@ func TestValidatePipelineSchema(t *testing.T) {
 								"action":  "Shell",
 								"command": "echo hello",
 								"timeout": "75m",
+								"shellIdentity": map[string]interface{}{
+									"value": "test-msi",
+								},
 							},
 						},
 					},