An app running in Azure may need to reach a database, storage account, or Key Vault. A managed identity gives its Azure resource an identity in Microsoft Entra ID, so the app can authenticate to supported services without storing a password or rotating a client secret. Azure manages the identity; you still decide what it may access. section 3.4.1 section 6.6.3
Choose the identity’s lifetime and scope to fit the job:
- System-assigned: enable it on one resource. Azure creates it, and deleting that resource deletes the identity. This is the simpler choice when one resource needs its own identity. section 6.6.3
- User-assigned: create it separately and attach it to one or more resources. It survives their deletion, but you must manage its assignments and delete it when it is no longer needed. section 6.6.3
Table 6.1 Comparing system-assigned and user-assigned managed identities
| Feature |
System-assigned |
User-assigned |
| Creation |
Created automatically when you enable it on an Azure resource |
Created as a standalone Azure resource, then assigned to one or more Azure resources |
| Life cycle |
Tied to the resource it’s enabled on Deleted automatically when the resource is deleted |
Exists independently of any resource Must be deleted manually |
| Resource scope |
Can only be used by the single resource it’s enabled on |
Can be used by multiple Azure resources, even across subscriptions (within the same tenant) |
| Management |
Very little management required with Azure handling creation and removal |
Requires you to assign and remove it from resources as needed |
| Best for |
Single-resource scenarios where the identity won’t need to be reused |
Shared-access scenarios or when you need a consistent identity across multiple resources |
Compare creation, lifecycle, resource scope, and management responsibilities before choosing a type. section 6.6.3
Give an App Service an identity
In the Azure Portal, open the App Service’s Identity blade. Under System-Assigned, turn the status On and save. Azure creates the identity in your Entra ID tenant. It has no access to other resources yet: on the target resource, use Access Control (IAM) to add an appropriate role assignment and select the managed identity as its member. Turning on the identity is not the same as granting permission. section 6.6.3
Connect an AI workflow to storage
When connecting an AI Foundry project to a storage account, select Microsoft Entra ID authentication for the connection. Then assign the workspace’s managed identity the Storage Blob Data Contributor role on the storage account. That role lets the workflow list, read, and write the blobs it needs; avoid granting broader access just in case. section 7.4.2
For an Azure-native app, managed identity avoids handling its authentication secret. A service principal is the more general-purpose alternative described for apps outside Azure and deployment tools such as Terraform or GitHub Actions. section 6.6.2
