Managed Identity

Managed Identity provides a secure service principal for an Azure (typically compute) resource for accessing other resources.

  • Prefer over credential-based (e.g., user/pwd) authentication with an OAuth token flow. Entra’s OAuth 2.0 Client Credentials Grant Flow
  • 24-hour token expiration; Azure refreshs at 12 hours
    • Uninterrupted if Entra unavailable < 24 hours
  • Certificate based, rather than credentials
    • Certs valid for 90 days; Azure rotates at 45 days

Types

  • User-assigned
    • Created and managed as a separate resource
    • Owner responsible for deprovising
    • May be assigned to multiple resources
  • System-assigned
    • Available for some Azure resources
    • Azure manages, including deprovisioning (shares the resource’s lifecycle)
    • Assigned to exactly 1 resource
    • Naming: uses the same name as the resource

Application Registration

  • A global (to Azure) identification of an application.
    • An app reg uniquely identifies an app and may also store properties, e.g., secrets, client id, certificates.
    • App reg facilitates how the app authenticates,
    • Roles/rights asso’d with a service principal.
    • The app reg belongs to the Az tenant where it was registered (home tenant).
    • The app reg may be used in other Az Tenants.
    • App reg trusts Entra ID, but not vice-versa.
    • Good for
      • need to authenticate users; SSO
      • app id across Az tenants
      • operate outside Az