3.1.2. Types of Identities
💡 First Principle: Not every identity in Microsoft Entra ID represents a human — it also represents software that needs to authenticate and act, and choosing the right identity type matters because each is managed, secured, and governed differently.
| Identity Type | Represents | Typical Use |
|---|---|---|
| User identity | A human being | Employees, guests, partners signing in |
| Service principal | An application or service | An app authenticating to call an API |
| Managed identity | An Azure resource, credential-free | A VM or function calling another Azure service without stored secrets |
| Agent ID | An AI agent acting on a task | An autonomous or semi-autonomous AI agent that needs its own governed identity, separate from the human who deployed it |
Managed identities are worth pausing on: they let an Azure resource (like a VM or Function App) authenticate to other Azure services without a developer ever storing a password or secret in code — Entra ID manages the credential automatically behind the scenes. Agent ID is a newer identity type reflecting the rise of AI agents that take autonomous action — rather than sharing a human's credentials, an agent gets its own identity, so its actions can be governed, audited, and access-scoped independently.
⚠️ Exam Trap: A service principal and a managed identity are not the same thing — a managed identity is a special, credential-free type of service principal that Azure creates and rotates automatically; not every service principal is a managed identity.
Reflection Question: Why would giving an AI agent its own agent ID, rather than letting it reuse a human employee's credentials, make that agent's actions easier to audit and govern?
