Managed identity
In Azure, a managed identity is an identity for software whose credentials are managed by the platform, allowing it to obtain Microsoft Entra tokens without developers handling those credentials.
The platform handles the credential
An application using a supported managed identity can obtain a token without storing a client secret in its configuration. Microsoft represents the identity with a special type of service principal.
The application still needs authorization to the destination. Enabling an identity does not, by itself, give it permission to read a storage account or change another service. Someone must grant the required access.
Azure provides two lifecycle models. A system-assigned identity belongs to one resource and is deleted with it. A user-assigned identity is a separate resource that can be attached to multiple supported resources and has its own lifecycle. “User-assigned” does not mean it represents a human user.
Protect the workload that can use it
Removing a stored secret removes one credential-handling problem. It does not make the workload’s permissions harmless. Code running with access to the managed identity can request tokens and use the access granted to it.
Review who can change or run code on that resource, which resources share the identity, and what the identity may do. Avoid granting broad permissions simply because the credential is managed automatically.