I don't believe we've tested authentication using Azure Managed Identity with Kubernetes pods but I don't think there is a reason why it wouldn't work since we are relying on the Azure Go SDK and it should work fine with workload identities according to the Microsoft documentation:
Azure AD workload identity works especially well with the Azure Identity client library using the Azure SDK...
In our implementation we are relying on authentication with ManagedIdentityCredential and let the SDK handle the rest:
ManagedIdentityCredential authenticates an Azure managed identity in any hosting environment supporting managed identities. This credential authenticates a system-assigned identity by default.
I've tried looking into how this works with workload identity and/or AAD pod identity and I don't really understand what you mean by "we will require the option to set the labels (and annotations) used by the backup pod", do you mean this is supposed to be something you can do using cbbackupmgr/in the backup service WebUI? To me it seems like an environment configuration step, which a user is supposed to do themselves, correct me if I'm wrong.