How deeply does Azure Security cover managed identity?

Defines both identity types, gives a CLI creation command, and defers permission details while noting service support limits.

Managed identity

As explained in Azure Security

A Microsoft Entra identity provisioned for an Azure resource or workload so it can authenticate to supported services without storing credentials such as passwords or certificates.

A managed identity gives an Azure resource an Azure AD identity for accessing supported cloud services without storing or managing passwords and certificates. It replaces the credential-handling burden of a service principal, reducing the risk that application secrets are exposed on resources or in source control. section 2.1.4 section 2.1.5

Choose the identity type by its lifetime and reuse needs:

System-assigned identities are tied to one Azure resource and are suited to that resource’s access to supported services. section 2.1.5
User-assigned identities are standalone Azure resources that multiple Azure resources can use. section 2.1.5
For large VM deployments, use a user-assigned identity to avoid creating one system-assigned identity per VM. section 9.1.4

Create a user-assigned identity in a resource group, then grant it permissions to the Azure resources it must access. The target service must support managed identities, and access should follow least privilege through Azure RBAC roles and scopes. section 2.1.6 section 2.3.2 section 2.14

az identity create --name MyManagedIdentity    #1
--resource-group MyResourceGroup                   #2
#1 The name of themanaged identity
#2 The resource group name in which the managed identity is created

Use this Azure CLI command in Cloud Shell to create a user-assigned identity; supply the identity name and destination resource group. section 2.1.6

App Service and VM operations

An App Service web application can use a managed identity to access Azure Storage without managed secrets. When installing Azure Monitor Agent across many VMs, a user-assigned identity can be shared; a system-assigned identity remains tied to each VM. section 4.5 section 9.1.4

How Azure Security covers it

liveBook manning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Microsoft Azure in ActionA managed identity is an Azure-managed identity for authenticating to supported services without users storing or handling credentials.
liveBook manning.com

Practical Automation with PowerShell: Effective scripting from the console to the cloudA managed identity is an Azure-managed identity that lets applications authenticate to supported resources without directly managing secrets.

Compare how 3 books explain managed identity →

Related concepts

system-assigned managed identityincludes · A system-assigned managed identity is an Azure-managed identity tied to a single resource whose lifecycle ends when that resource is deleted.
user-assigned managed identityincludes · A user-assigned managed identity is an independently managed Azure identity that can be associated with multiple resources.
service principalalternative to · A service principal is a nonhuman application or service identity that authenticates and receives authorized access to resources.
storage accountused by · A storage account is a top-level Azure resource that provides a namespace, access boundary, and configuration for storage services and their data.
Azure OpenAIused by · Azure OpenAI Service is Microsoft’s managed Azure cloud service for accessing OpenAI models through Azure-hosted deployments, APIs, infrastructure, and controls.
Microsoft Azure Foundryused by · Microsoft Azure AI Foundry is Microsoft's Azure platform for accessing AI models and developing, customizing, deploying, and orchestrating AI applications and agents.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.