Secure access with managed identities

Implement Azure Security for Developers

Anushika Agarwal

Cloud Data Engineer

The problem with secrets

  • Secrets hardcoded in code or config
  • Difficult to rotate or protect

Risk of hardcoded secrets

Implement Azure Security for Developers

Managed identity

  • Secure Identity assigned to Azure resource
  • Resource can securely access other services
  • No need of storing credentials

Managed Identity

Implement Azure Security for Developers

How it works?

  • Special type of service principal
  • Fully managed by Azure
  • Azure handles creation, rotation & deletion

Managed Identity

Implement Azure Security for Developers

Example: PeopleSphere HR app

  • Payroll module uses managed identity to access Key Vault

Example - PeopleSphere HR app

Implement Azure Security for Developers

System-assigned managed identity

  • Provisioning

    • Azure auto-creates an identity
    • No credentials or manual setup needed

  • Lifecycle

    • Lifecycle ends with the resource
    • Bound to a single resource

  • Access Control

    • Assign roles via Azure RBAC

Implement Azure Security for Developers

User-assigned managed identity

  • Provisioning

    • Created as a standalone Azure resource
    • One access policy, multiple resources

  • Lifecycle

    • Reusable across multiple services
    • Independent of any one resource

  • Access Control

    • Assign roles via Azure RBAC

User-Assigned Managed Identity

Implement Azure Security for Developers

System vs. user-assigned: key differences

Category System-Assigned User-Assigned
Provisioning Created with the resource Created as a separate resource
Lifecycle Tied to the resource's lifecycle Independent of resource lifecycle
Reusability Cannot be shared across resources Can be reused across services
Access Uses Azure RBAC Uses Azure RBAC
Use Case Single-resource workloads Multi-resource or pre-provisioned setups
Implement Azure Security for Developers

What services support managed identities?

  • Any service that supports Microsoft Entra authentication

  • Common Examples:

    • Virtual Machines
    • App Services
    • Azure Functions
    • Key Vault
    • Azure Storage

  • Full list: Microsoft Docs - Supported Services

Virtual Machines

App Services

Azure Functions

Key Vault

Azure Storage

Implement Azure Security for Developers

Let's practice!

Implement Azure Security for Developers

Preparing Video For Download...