Managed Identities

A managed identity is an Entra ID identity automatically managed by Azure. It allows resources such as App Services, Functions, VMs, and Container Apps to authenticate to other Azure services without storing credentials in code or configuration.

Identity Types

• System-assigned — Created and tied to a single Azure resource. Automatically deleted when the resource is deleted. Suitable for workloads where a 1:1 relationship between resource and identity is appropriate
• User-assigned — Created as a standalone Azure resource and assigned to one or more resources. Persists independently of the resources it is assigned to. Preferred when multiple resources share the same permissions, or when the identity lifecycle must be managed separately

How It Works

1. A managed identity is assigned to an Azure resource (e.g. an App Service)
2. Azure issues the resource a token via the Instance Metadata Service (IMDS) endpoint
3. The resource uses that token to authenticate to target services (e.g. Key Vault, Storage, SQL)
4. Access is controlled by assigning Azure RBAC roles (or service-specific permissions) to the managed identity

No secrets, passwords, or certificates need to be stored or rotated by the application.

Common Use Cases

• Reading secrets or keys from Azure Key Vault
• Reading and writing blobs to Azure Storage
• Connecting to Azure SQL without a password (using Authentication=Active Directory Default in the connection string)
• Calling other Azure REST APIs or services that support Entra ID authentication

Common Built-in RBAC Roles

Key Vault

Storage

Usage

# Enable system-assigned identity on an App Service
Set-AzWebApp -ResourceGroupName "rg-myapp-prod-uks-01" -Name "app-myapp-prod-uks-01" -AssignIdentity $true
 
# Create a user-assigned managed identity
New-AzUserAssignedIdentity -ResourceGroupName "rg-myapp-prod-uks-01" -Name "id-myapp-prod-uks-01" -Location "uksouth"
 
# Assign a user-assigned identity to an App Service
$identity = Get-AzUserAssignedIdentity -ResourceGroupName "rg-myapp-prod-uks-01" -Name "id-myapp-prod-uks-01"
$app = Get-AzWebApp -ResourceGroupName "rg-myapp-prod-uks-01" -Name "app-myapp-prod-uks-01"
Update-AzWebApp -ResourceGroupName "rg-myapp-prod-uks-01" -Name "app-myapp-prod-uks-01" `
  -IdentityType "UserAssigned" `
  -IdentityId $identity.Id
 
# Grant the identity access to Key Vault secrets
New-AzRoleAssignment `
  -ObjectId $identity.PrincipalId `
  -RoleDefinitionName "Key Vault Secrets User" `
  -Scope "/subscriptions/<sub-id>/resourceGroups/rg-myapp-prod-uks-01/providers/Microsoft.KeyVault/vaults/kv-myapp-prod-uks-01"

# Enable system-assigned identity on an App Service
az webapp identity assign \
  --resource-group "rg-myapp-prod-uks-01" \
  --name "app-myapp-prod-uks-01"
 
# Create a user-assigned managed identity
az identity create \
  --resource-group "rg-myapp-prod-uks-01" \
  --name "id-myapp-prod-uks-01" \
  --location "uksouth"
 
# Assign a user-assigned identity to an App Service
IDENTITY_ID=$(az identity show \
  --resource-group "rg-myapp-prod-uks-01" \
  --name "id-myapp-prod-uks-01" \
  --query id -o tsv)
 
az webapp identity assign \
  --resource-group "rg-myapp-prod-uks-01" \
  --name "app-myapp-prod-uks-01" \
  --identities $IDENTITY_ID
 
# Grant the identity access to Key Vault secrets
PRINCIPAL_ID=$(az identity show \
  --resource-group "rg-myapp-prod-uks-01" \
  --name "id-myapp-prod-uks-01" \
  --query principalId -o tsv)
 
az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Key Vault Secrets User" \
  --scope "/subscriptions/<sub-id>/resourceGroups/rg-myapp-prod-uks-01/providers/Microsoft.KeyVault/vaults/kv-myapp-prod-uks-01"

Adding to Azure SQL

Managed identities authenticate to Azure SQL using Entra ID. The identity must first be added as a database user.

-- Create the user from the external provider (Entra ID)
CREATE USER [id-myapp-prod-uks-01] FROM EXTERNAL PROVIDER
 
-- Grant read/write access
ALTER ROLE db_datareader ADD MEMBER [id-myapp-prod-uks-01]
ALTER ROLE db_datawriter ADD MEMBER [id-myapp-prod-uks-01]

The SQL server itself also needs an Entra ID admin set, and the connection string should use Authentication=Active Directory Default (or Active Directory Managed Identity for explicit identity selection).

System-assigned vs User-assigned

• Use system-assigned for simple, single-resource scenarios where you want automatic lifecycle management
• Use user-assigned when multiple resources need the same permissions, when you need to pre-assign roles before deploying the resource, or when identity continuity across resource redeployments is required
• Prefer user-assigned in most production scenarios for consistency and reusability

Best Practices

• Always prefer managed identities over service principals with client secrets for Azure-hosted workloads
• Apply the principle of least privilege—assign only the roles the identity needs, scoped as narrowly as possible (resource scope over resource group scope over subscription scope)
• Use user-assigned identities for production workloads to decouple identity lifecycle from resource lifecycle
• Avoid giving managed identities Owner or Contributor at broad scopes unless strictly necessary
• Regularly audit role assignments on managed identities using Azure Policy or Access Reviews
• Follow the naming convention: id-<app>-<environment>-<location>-<instance> (e.g. id-myapp-prod-uks-01)