Managed identities are Azure's answer to the oldest problem in cloud security: how does one service prove who it is to another without a password sitting in a config file? The idea is elegant once it clicks. Here is the model.
The Problem They Solve
Normally, App A calling App B needs a credential — a client secret, a connection string, an API key. That credential has to live somewhere, and wherever it lives, it can leak. Managed identities remove the credential entirely: Azure vouches for your resource's identity directly, so there is no secret to store, rotate, or leak.
What a Managed Identity Actually Is
A managed identity is a service principal in Microsoft Entra ID that is tied to an Azure resource and managed by the platform. Your VM, Function, or App Service gets an identity; Azure handles the credentials behind it and rotates them automatically. Your code just asks the platform for a token:
// No secret anywhere — the platform issues the token var credential = new DefaultAzureCredential(); var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential); KeyVaultSecret secret = await client.GetSecretAsync("db-conn");
System-Assigned vs User-Assigned
There are two flavors:
- ▸System-assigned — created with a resource and deleted with it. One identity, one resource, tied lifecycle. Best when the identity belongs to exactly one thing.
- ▸User-assigned — a standalone identity you create once and attach to many resources. Best when several resources should share one identity, or the identity should outlive any single resource.
az identity create --name shared-id --resource-group my-rg az webapp identity assign --name my-app --resource-group my-rg \ --identities /subscriptions/.../shared-id
How Authorization Follows
Having an identity isn't the same as having access. You still grant that identity roles — the difference is you are granting to a platform-managed principal instead of managing a secret. Assign it exactly the roles its workload needs, nothing more.
Summary
A managed identity is a platform-managed service principal attached to an Azure resource, letting it authenticate with no stored credential — Azure issues and rotates the tokens for you. Use system-assigned when the identity belongs to one resource, user-assigned when it is shared or long-lived, and grant it least-privilege roles like any other principal. It is the cleanest way to kill secrets in your Azure architecture.