So I actually have two depending on how one wants to implement. The first would be to include the app service as part of the security script. This would tie the MSI auth to part of the database deployment process Deploying .dacpacs to Multiple Environments via ADO Pipelines | Microsoft Community Hub
Alternatively, one can have the ADO service connection be a member of the Entra AD admin and then execute an inline sql script to add the app service MSI as a user. This would tie the auth to the app service deployment. i.e. run this after the app service has been deployed. Both are acceptable, I would probably fall back to how much security will be configured, organizational preference, and lifecycle of the database vs the application.