📖 What is Microsoft Entra ID Managed Identity?
Microsoft Entra ID Managed Identity is an identity automatically managed by Microsoft Entra ID for Azure resources to authenticate to other services without storing credentials in code. It simplifies secret management by eliminating the need for manual rotations.
"This is the gold standard for security because it removes the need for developers to handle client secrets or certificates entirely."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra ID Managed Identity?
- ▸ System-assigned identities are tied directly to a single Azure resource and are automatically deleted when that resource is removed from the environment.
- ▸ User-assigned identities are standalone Azure resources that can be assigned to multiple services, providing a consistent identity across a fleet of resources.
- ▸ Managed Identities eliminate the need for developers to manage credentials, preventing the risk of leaking client secrets in source code or configuration files.
- ▸ Integration with Azure RBAC allows administrators to assign granular permissions to the identity, ensuring the principle of least privilege is strictly maintained.
- ▸ The service automates the rotation of service principal credentials, removing the manual overhead and security risks associated with expiring certificates or passwords.
🎯 How does Microsoft Entra ID Managed Identity appear on the MS-102 Exam?
You may be asked to recommend a security improvement for an application running on an Azure VM that currently stores a client secret in a config file to access Azure Key Vault.
A scenario might describe a requirement where multiple Azure Functions must share the same set of permissions to a storage account; you must identify User-assigned Managed Identity as the solution.
❓ Frequently Asked Questions
When should I choose a User-assigned identity over a System-assigned identity?
Use User-assigned identities when multiple resources need the same permissions or when you want the identity to persist independently of the resource's lifecycle, simplifying deployment and management at scale.
Does Managed Identity replace the need for Service Principals?
Managed Identities are essentially a wrapper around Service Principals. They replace the need for manual Service Principal management for Azure resources, but traditional Service Principals are still required for external applications.