Using Managed Identities to Access Azure Resources Securely – Vaibhav Gujral’s Blog

In the world of cloud computing, managing and securing application credentials can be a challenge. Hardcoding credentials or managing secrets manually increases the risk of breaches and adds operational overhead. Managed Identities in Azure provide a seamless and secure way for your applications to access Azure resources without explicit credentials. This article dives deep into how Managed Identities work, their benefits, and how to implement them with real-world examples.

Managed Identities are a feature of Azure Entra ID (formerly Azure Active Directory) that automatically manages the identity of your Azure resources. When you enable a Managed Identity for a resource, Azure creates and rotates the credentials, ensuring secure communication between your application and other Azure services.

1. System-Assigned Managed Identity: Tied to a specific Azure resource. If the resource is deleted, the identity is also removed.
2. User-Assigned Managed Identity: Created as a standalone Azure resource and can be assigned to multiple Azure resources.

• Eliminate Credential Management: There is no need to store credentials in your code or manage secret rotation.
• Enhanced Security: Reduces the risk of credential leaks by providing a secure, managed identity for Azure resources.
• Seamless Integration: Works natively with Azure services like Azure Key Vault, Azure Storage, and Azure SQL Database.
• Simplified Role Assignments: Easily assign roles to identities for fine-grained access control.

When you enable a Managed Identity for a resource:

1. Azure generates an identity in Azure Entra ID.
2. The resource can use this identity to authenticate to Azure services via OAuth2 tokens.
3. The token is used to access resources based on the assigned permissions.

Let’s enable a system-assigned Managed Identity for an Azure Virtual Machine (VM).

Using Azure CLI:

# Enable System-Assigned Managed Identity on a VM
az vm identity assign --name MyVM --resource-group MyResourceGroup

Using Azure Portal:

1. Navigate to your Virtual Machine.
2. Under “Settings,” select “Identity.”
3. Turn on the “System Assigned” toggle and save.

Once the identity is enabled, you must assign it a role to access Azure resources.

Assigning Role to Access Azure Key Vault

# Assign Key Vault Reader role to the VM's Managed Identity
az role assignment create --assignee  \
--role "Key Vault Reader" \
--scope /subscriptions//resourceGroups//providers/Microsoft.KeyVault/vaults/

Using Azure CLI

# Create a User-Assigned Managed Identity
az identity create --name MyUserAssignedIdentity --resource-group MyResourceGroup

Using Azure Portal

1. Go to the Azure Portal.
2. Navigate to Managed Identities under your resource group.
3. Click Create, select User-Assigned, and configure the name and region.

Once created, assign the User-Assigned Managed Identity to one or more resources.

Assigning to a Virtual Machine (VM)

# Assign User-Assigned Managed Identity to a VM
az vm identity assign --resource-group MyResourceGroup --name MyVM --identities MyUserAssignedIdentity

Using Azure Portal

1. Go to the VM’s Identity settings.
2. Select User-Assigned under Assigned Identities.
3. Add the created Managed Identity.

To allow the Managed Identity to access a resource (e.g., Azure Key Vault):

# Assign a role to the User-Assigned Managed Identity
az role assignment create --assignee  \
--role "Key Vault Reader" \
--scope /subscriptions//resourceGroups//providers/Microsoft.KeyVault/vaults/

Let’s write a Python application running on the Azure VM that fetches secrets from the Azure Key Vault using its Managed Identity.

• Azure CLI installed for local testing.
• Azure Identity and Azure Key Vault client libraries installed:

pip install azure-identity azure-keyvault-secrets

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient



# Key Vault URL
key_vault_url = "https://.vault.azure.net/"









# Use DefaultAzureCredential to authenticate using the Managed Identity
credential = DefaultAzureCredential()
client = SecretClient(vault_url=key_vault_url, credential=credential)









# Retrieve a secret from the Key Vault
secret_name = "MySecret"
retrieved_secret = client.get_secret(secret_name)









print(f"Secret Value: {retrieved_secret.value}")

• DefaultAzureCredential automatically detects and uses the Managed Identity of the VM.
• The SecretClient fetches the secret from Azure Key Vault.

1. Use System-Assigned Managed Identity for Single Resource: Use system-assigned identities when the identity is tied to the lifecycle of a single resource.
2. Leverage User-Assigned Managed Identity for Shared Resources: If multiple resources need the same identity, use user-assigned Managed Identities.
3. Minimize Permissions: Follow the principle of least privilege by assigning the minimum necessary permissions.
4. Monitor Usage: Use Azure Monitor and Azure Activity Logs to track token usage and access attempts.
5. Secure Network Access: Combine Managed Identities with Virtual Network (VNet) and Private Endpoints for enhanced security.

• Ensure the Managed Identity is enabled and correctly assigned.
• Verify role assignments and permissions for the identity.

• Check if the Managed Identity has the necessary permissions for the resource.
• Use Azure CLI to verify role assignments.

az role assignment list --assignee 

Managed Identities simplify secure access to Azure resources, eliminating the need for manual credential management. By following the steps and best practices outlined in this article, you can integrate Managed Identities into your applications and leverage their security and operational benefits.