AZ 305 — Managed Identities

Summary

Managed identities in Microsoft Entra ID (formerly Azure AD) provide secure identity management for Azure resources, eliminating the need to share credentials. These identities are authenticated against Entra ID to ensure proper permissions for resource manipulation. There are two types: System-assigned identities, automatically tied to a single resource and deleted with it, and user-assigned identities, manually created and managed independently, capable of being shared across multiple resources. Both types enhance security, streamline resource management, and avoid credential exposure, offering flexible and efficient solutions for Azure environments.

Takeaways

• 😀 Managed identities in Microsoft Entra ID (Azure AD) associate identities with Azure resources to increase security by eliminating exposed credentials.
• 😀 Managed identities can be used to authenticate Azure resources without the need to share sensitive information like passwords.
• 😀 There are two types of managed identities: System-assigned and User-assigned.
• 😀 System-assigned managed identities are automatically created and tied to the lifecycle of the Azure resource they are associated with.
• 😀 User-assigned managed identities are manually created and managed, and their lifecycle is independent of the Azure resources they are linked to.
• 😀 System-assigned identities cannot be shared and are tied to a single Azure resource, while user-assigned identities can be shared across multiple resources.
• 😀 When a system-assigned resource is deleted, its associated identity is automatically deleted as well.
• 😀 User-assigned identities must be deleted explicitly and are not automatically removed when the resource is deleted.
• 😀 Managed identities provide secure access to resources like Azure Key Vault without exposing secrets or credentials over the network.
• 😀 By using managed identities, Azure resource management becomes more efficient, with roles and permissions being managed directly within Entra ID.
• 😀 The integration of managed identities enhances overall security by ensuring that Azure resources authenticate and authorize each other seamlessly.

Q & A

What are managed identities in Microsoft Entra ID?

Managed identities in Microsoft Entra ID (formerly Azure AD) are security features that associate identities with Azure resources, allowing them to authenticate and interact with other services without exposing sensitive credentials.

How do managed identities enhance security?

Managed identities enhance security by eliminating the need to share credentials over the network. Resources can authenticate directly with Azure AD, reducing the risk of credential exposure.

What is the difference between system-assigned and user-assigned managed identities?

System-assigned identities are automatically created and tied to a single Azure resource, with their lifecycle tied to the resource's lifecycle. User-assigned identities are manually created, can be shared across multiple resources, and have an independent lifecycle.

Can a system-assigned identity be shared across multiple resources?

No, a system-assigned identity is linked to a single Azure resource and cannot be shared with others.

What happens to a system-assigned identity when the associated Azure resource is deleted?

When the associated Azure resource is deleted, the system-assigned identity is also deleted automatically.

How is the lifecycle of a user-assigned identity different from a system-assigned identity?

A user-assigned identity has an independent lifecycle from the resources it is associated with, meaning it must be manually deleted if no longer needed, whereas a system-assigned identity is deleted automatically when its resource is deleted.

What type of resources can use a user-assigned identity?

A user-assigned identity can be associated with multiple Azure resources, allowing it to be shared and used across different services.

Where are managed identities configured in Azure?

Managed identities are configured through the identity blade in the Azure portal, where administrators can assign roles and permissions to the identity.

What is an example use case for managed identities?

A common use case is allowing an application to access Azure Key Vault to retrieve secrets, such as API keys, without exposing any passwords or credentials.

What role does Azure AD play in managed identities?

Azure AD manages the identities associated with resources, providing authentication and token issuance, ensuring resources have the necessary permissions to interact securely with each other.