4.1.2. Creating and Using Managed Identities
💡 First Principle: A managed identity is a service principal whose credential lives inside Azure's fabric — the platform authenticates the resource, so your code just asks its local endpoint for tokens. Your only real design decision is lifecycle: die-with-the-resource (system-assigned) or live-independently-and-share (user-assigned).
System-assigned: enabled as a property of one resource (VM, App Service, Function…); Entra creates a service principal 1:1 with it; delete the resource and the identity (and every role assignment on it) evaporates. User-assigned: created as a standalone Azure resource, then attached to one or many resources; it survives their deletion and carries its role assignments across re-deployments. Choose user-assigned when several resources need identical permissions (assign once, attach many), when infrastructure is recreated frequently (blue-green, scale sets) and re-granting roles each time is unacceptable, or when permissions must be provisioned before the compute exists.
Usage is two steps, and both get tested. First, grant the identity access: its service principal is a principal like any other — give it Azure RBAC roles ("Storage Blob Data Reader on this account"), Graph application permissions (admin-consented), or Key Vault access. Second, acquire tokens from inside the resource:
In practice code uses DefaultAzureCredential (Azure SDK), which transparently hits the endpoint; on VMs it's the instance metadata service, in App Service an equivalent local endpoint. When a resource has multiple identities attached, code must specify which (client ID) — a classic troubleshooting stem.
⚠️ Exam Trap: Deleting a resource with a system-assigned identity orphans nothing — but deleting and recreating it produces a new identity that has none of the old role assignments. "After redeployment the app gets 403s" → the roles died with the old identity; the durable fix is user-assigned.
Reflection Question: A scale set of 50 identical VMs must all read the same Key Vault. Argue user-assigned over system-assigned in one sentence about role assignments — then name what still limits the blast radius if one VM is compromised.
