Managed Identities for Azure Resources
Credential-free service principals for workloads: the platform issues and rotates the secret so code never stores one.
Readiness
0%
1h 30m baseline
Exam memorization points
- System-assigned: created with the resource, tied to its lifecycle, one identity per resource, deleted when the resource is deleted.
- User-assigned: an independent resource that can be attached to many resources and survives their deletion.
- Both are backed by a service principal in Microsoft Entra ID, so access is granted with an ordinary RBAC role assignment to the identity's object id.
- Tokens are obtained from the Instance Metadata Service at 169.254.169.254 for VMs, or from the resource's local endpoint for other services.
- Managed identity cannot be assigned to on-premises servers; use a service principal or Azure Arc-enabled servers instead.
Traps & distractors
- Granting the RBAC role to the resource instead of to the managed identity object, which results in 403s.
- Assuming every Azure service supports managed identity - support is service by service and must be checked.
- Using a system-assigned identity where the identity must survive resource replacement; a user-assigned identity is the correct answer there.
- Expecting cross-tenant trust. Managed identities are tenant-bound.
Suggested lab
Read a Key Vault secret with a managed identity
Wire up an identity, an RBAC role and a caller with no stored credentials.
- 1Create a VM and enable a system-assigned managed identity.
- 2Create a Key Vault and grant the VM's identity the Key Vault Secrets User role.
- 3On the VM, request a token from the Instance Metadata Service and call the Key Vault REST API to read a secret.
- 4Create a user-assigned identity, attach it to a second VM and confirm the same RBAC approach works.
- 5Delete the first VM and observe that its system-assigned identity disappears from enterprise applications.
Microsoft Learn
- What are managed identities for Azure resources?doc
- Search Microsoft Learn: managed identity system-assigned user-assigned RBAC rolesearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
High priority
Strong exam value. Schedule this week.
- Exam importance80% × 30% = 24.0
Learner-agnostic frequency on the real exam (4/5).
- Blueprint weight100% × 25% = 25.0
This topic's domain carries 22.5% of the exam objectives.
- Dependency leverage0% × 20% = 0.0
Nothing else in the graph depends on this topic.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Leaf topic - nothing depends on it.
Baseline study time
1h 30m
Complexity
2 / 5
Remaining to target
1h 17m
Status weight
0%
Topics: service principal, identity, imds, key vault, credential-free
Weak neighbours in Identities