liveBook · Manning

User-assigned managed identity

As explained in Azure Security

A user-assigned managed identity is a standalone Azure resource that can be assigned to one or more Azure resources.

A user-assigned managed identity is a standalone Azure resource that lets multiple Azure resources authenticate to supported cloud services without storing passwords, certificates, or service-principal secrets. section 2.1.5

Use it when:

  • Several Azure resources need the same identity for Azure AD-authenticated access. section 2.1.5
  • A deployment needs to avoid creating one system-assigned identity per resource. section 9.1.4
  • The target Azure service supports managed identities and the identity has been granted appropriate permissions. section 2.1.6

Create the identity in a resource group with Azure Cloud Shell, then assign permissions to the Azure resources it must access. The resulting resource exposes identifiers such as clientId, principalId, tenantId, and its resource ID. section 2.1.6

az identity create --name MyManagedIdentity    #1
--resource-group MyResourceGroup                   #2
#1 The name of themanaged identity
#2 The resource group name in which the managed identity is created

Shows the Azure CLI command for creating MyManagedIdentity and identifies its name and resource-group arguments. section 2.1.6

Reuse across virtual machines

For Azure Monitor Agent deployments across 100 VMs, one user-assigned identity can be reused instead of creating 100 system-assigned identities. Configure the VM extension with the identity's resource ID. section 9.1.4

Listing 9.1 Installing AMA on Azure VM
az vm extension set –name AzureMonitorWindowsAgent              #1
--publisher Microsoft.Azure.Monitor                           #2
--ids <vm-resource-id>                                        #3
--enable-auto-upgrade true                                    #4
--settings '{"authentication":
  {"managedIdentity":{"identifier-name":"mi_res_id","identifier-value":"
  /subscriptions/<my-subscription-id>/resourceGroups/
  <my-resource-group>/providers/Microsoft.ManagedIdentity
  /userAssignedIdentities/
  <my-user-assigned-identity>"}}}'                            #5
#1 The name of the VM extension. To install AMA, the value needs to be AzureMonitorWindowsAgent.
#2 The name of the extension publisher
#3 One or more of your resource IDs
#4 Enables automatic updates of the extension whenever a newer version of the extension is available
#5 JSON format with the user-assigned managed identity used to install AMA on the VM

Shows Azure Monitor Agent installation using the user-assigned identity resource ID and enables automatic extension upgrades. section 9.1.4

How Azure Security covers it

How deep it goes
Explains creation, identifiers, permissions, service support, and large-scale VM use, but defers detailed permission configuration.
Examples
Uses Azure Cloud Shell creation commands, representative identity output, and Azure Monitor Agent installation across multiple virtual machines.
What it assumes
Assumes a resource group and supported Azure service; teaches the identity creation workflow before authentication and permission details.
What you can do after
Build it from scratch with Azure CLI, grant access, and configure Azure Monitor Agent to authenticate through the identity.
How it connects
Connects managed identities with system-assigned identities, service principals, Azure AD authentication, Azure Monitor Agent, and virtual machines.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.