Quartz 5

managed-identity

Properties2
tagsidentity, azure, automation
aliasessystem-assigned managed identity, user-assigned managed identity

2 min read

Managed identity

What it is

A managed identity is a Microsoft Entra identity that Azure creates and manages for a supported Azure resource. The workload can request a token as that identity without storing a password, client secret, or certificate in its code or configuration.

Why it exists

Applications and automation often need to access Key Vault, Storage, or other Azure services. A managed identity removes the need to distribute and rotate a client secret in that workload.

Key ideas

  • A system-assigned identity belongs to one Azure resource and is removed when that resource is removed.
  • A user-assigned identity is a separate Azure resource with its own lifecycle and can be attached to more than one supported Azure resource.
  • The workload requests a token, then presents that token to a service. The identity still needs an RBAC role or service-specific data permission. Identity issuance is not permission.
  • Managed identity avoids storing a credential, but it does not remove the need to protect the workload, constrain its network path, monitor its access, or apply least privilege.

Northwind example

Northwind enables a system-assigned managed identity on its ordering app. Maya grants that identity the narrowly scoped role needed to read the required secret from Key Vault. At runtime the app requests a token and uses it to retrieve the secret. No connection string is committed to the source repository. If Northwind instead needed one identity shared by several supported workloads, it would evaluate a user-assigned identity and its independent lifecycle.

Common confusion

  • Managed identity is an identity, not a permission. A token alone does not let an app read storage or Key Vault.
  • A managed identity is not a human login and should not be used for interactive administration.
  • An external CI/CD runner should generally use workload identity federation, not pretend it is an Azure-hosted managed identity.

service-principal · rbac · secretless-pipeline-authentication · key-vault · northwind-traders-case-study

Source: Microsoft Learn — Managed identities for Azure resources, checked 2026-09-16.

Graph View

Backlinks