📚 AZ-104 Series: This is Part 14 of 67 in the complete Azure Administrator (AZ-104) study guide.

Introduction

As you prepare for the AZ-104 exam, understanding Managed Identities in Azure is crucial. This topic is essential for the exam, as it covers a significant portion of the Azure Active Directory (AAD) and security aspects. In this blog post, we will delve into the world of Managed Identities, exploring what they are, how they work, and why they matter. By the end of this post, you will have a solid understanding of Managed Identities, including system-assigned and user-assigned identities, their use cases, and how to implement them using the Azure Portal and Azure CLI.

Managed Identities are a fundamental concept in Azure, allowing you to authenticate and authorize resources without managing credentials. This is particularly important in cloud environments, where security and identity management are critical. Azure provides two types of Managed Identities: system-assigned and user-assigned. We will explore these concepts in detail, using analogies and examples to help you understand the differences and use cases.

Why is this topic important for the AZ-104 exam? The exam covers various aspects of Azure, including security, identity, and access management. Understanding Managed Identities is essential to demonstrate your knowledge of Azure’s security features and how to implement them in real-world scenarios. By mastering this topic, you will be able to design and implement secure solutions in Azure, which is a critical skill for any Azure administrator or developer.

Core Concepts

Let’s start with the basics. A Managed Identity is a secure way to authenticate and authorize resources in Azure without managing credentials. Think of it like a digital identity card that allows your resources to access other services and resources in Azure. There are two types of Managed Identities: system-assigned and user-assigned.

System-assigned Managed Identities are created and managed by Azure. They are tied to a specific resource, such as a virtual machine or a function app, and are deleted when the resource is deleted. This type of identity is useful when you need to authenticate a resource to access other services in Azure, but you don’t need to reuse the identity across multiple resources.

User-assigned Managed Identities, on the other hand, are created and managed by you. They can be assigned to multiple resources, and you have full control over their lifecycle. This type of identity is useful when you need to reuse an identity across multiple resources or when you need to manage the identity independently of a specific resource.

To illustrate the difference, consider a scenario where you have multiple virtual machines that need to access a storage account. You can create a user-assigned Managed Identity and assign it to all the virtual machines, allowing them to access the storage account without managing individual credentials. In contrast, if you have a single virtual machine that needs to access a storage account, you can use a system-assigned Managed Identity, which will be created and managed by Azure.

How It Works

Now that we have covered the core concepts, let’s dive deeper into the architecture and components of Managed Identities. The process involves several components, including Azure Active Directory (AAD), the Managed Identity service, and the resource that needs to authenticate.

Here’s a step-by-step overview of how it works: when you create a Managed Identity, Azure creates a service principal in AAD, which represents the identity. The service principal is then used to authenticate the resource to access other services in Azure. The Managed Identity service handles the authentication and authorization process, eliminating the need for you to manage credentials.

The architecture involves several components, including the Azure Resource Manager (ARM), the Managed Identity service, and AAD. ARM provides the infrastructure for creating and managing resources, while the Managed Identity service handles the authentication and authorization process. AAD provides the identity management framework, allowing you to manage access and permissions.

Imagine a scenario where you have a virtual machine that needs to access a storage account. The virtual machine is assigned a Managed Identity, which is used to authenticate the virtual machine to the storage account. The Managed Identity service handles the authentication process, allowing the virtual machine to access the storage account without managing credentials.

Step-by-Step Guide: Azure Portal

1. Log in to the Azure Portal and navigate to the resource that you want to assign a Managed Identity to, such as a virtual machine or a function app.
2. Click on the “Identity” tab and select “Status” as “On” to enable the system-assigned Managed Identity.
3. Alternatively, you can create a user-assigned Managed Identity by navigating to the “Managed Identities” section in the Azure Portal and clicking on “New managed identity”.
4. Enter a name and description for the Managed Identity, and select the subscription and resource group.
5. Click on “Review + create” and then “Create” to create the Managed Identity.
6. Once the Managed Identity is created, you can assign it to a resource by navigating to the resource and clicking on the “Identity” tab.
7. Select the user-assigned Managed Identity from the list and click on “Save” to assign it to the resource.
8. Verify that the Managed Identity is working by checking the resource’s logs or by using the Azure CLI to test the authentication.

Azure CLI Commands


az identity create --name myManagedIdentity --resource-group myResourceGroup


az vm identity assign --name myVM --resource-group myResourceGroup --identities myManagedIdentity


az functionapp identity assign --name myFunctionApp --resource-group myResourceGroup --identities myManagedIdentity


az storage blob upload --file myFile.txt --container myContainer --name myFile.txt --account-name myStorageAccount --account-key myStorageAccountKey --auth-mode login --identity myManagedIdentity


The above commands demonstrate how to create a Managed Identity, assign it to a virtual machine and a function app, and use it to authenticate to a storage account. The az identity create command creates a new Managed Identity, while the az vm identity assign and az functionapp identity assign commands assign the Managed Identity to a virtual machine and a function app, respectively. The az storage blob upload command uses the Managed Identity to authenticate to a storage account and upload a file.

Real-World Use Cases

Now that we’ve covered the basics of Managed Identities in Azure, let’s dive into some real-world use cases to help illustrate how this feature can be applied in practical scenarios. Here are three detailed examples:

In the first scenario, suppose we have a web application running on an Azure App Service, and this application needs to access data stored in an Azure Storage account. Without Managed Identities, we would need to store the storage account credentials (like the account key) in our application code, which is not secure. But with Managed Identities, we can enable the App Service to use a managed identity to authenticate to the storage account, eliminating the need to store credentials in code.

In the second scenario, imagine we have an Azure Function that needs to interact with an Azure Cosmos DB database. The function needs to read and write data to the database, but we don’t want to hardcode the database credentials into the function code. By enabling Managed Identities on the function, we can grant it access to the Cosmos DB database without storing any credentials, making our solution more secure and easier to manage.

In the third scenario, let’s say we have an Azure Virtual Machine (VM) that needs to access an Azure Key Vault to retrieve secrets and certificates. Traditionally, we would need to install the Azure SDK on the VM and authenticate using a service principal or username and password. But with Managed Identities, we can enable the VM to use a managed identity to authenticate to Key Vault, simplifying the process and reducing the administrative burden.

• Web application accessing Azure Storage
• Azure Function interacting with Azure Cosmos DB
• Azure VM accessing Azure Key Vault

Best Practices

To get the most out of Managed Identities in Azure, follow these best practices:

First, enable Managed Identities on all supported Azure services to simplify authentication and authorization. This includes App Services, Functions, Logic Apps, and Virtual Machines, among others.

Second, use the principle of least privilege when assigning permissions to managed identities. Only grant the necessary permissions to perform the required tasks, and avoid assigning overly broad permissions that could be exploited by malicious actors.

Third, monitor and audit managed identity activity to detect and respond to potential security incidents. Use Azure Audit Logs and Azure Monitor to track managed identity usage and identify suspicious patterns.

Fourth, rotate credentials regularly to minimize the impact of a credential compromise. Managed Identities automatically rotate credentials, but it’s still important to review and update permissions regularly.

Fifth, use managed identities with other Azure security features, such as Azure Active Directory (AAD) Conditional Access and Azure Policy, to create a layered security approach.

Sixth, test and validate managed identity configurations to ensure they are working as expected. Use tools like the Azure CLI and Azure SDKs to verify managed identity functionality.

Seventh, document managed identity configurations to ensure that knowledge is shared across teams and that configurations are properly maintained.

Eighth, plan for managed identity limitations and constraints, such as the number of managed identities that can be created per subscription.

1. Enable Managed Identities on all supported Azure services
2. Use the principle of least privilege when assigning permissions
3. Monitor and audit managed identity activity
4. Rotate credentials regularly
5. Use managed identities with other Azure security features
6. Test and validate managed identity configurations
7. Document managed identity configurations
8. Plan for managed identity limitations and constraints

Common Mistakes to Avoid

When working with Managed Identities in Azure, be aware of these common mistakes to avoid:

Mistake number one: not enabling Managed Identities on supported services. Failing to enable Managed Identities can lead to insecure credential storage and authentication practices.

Mistake number two: assigning overly broad permissions to managed identities. This can increase the risk of a security incident, as malicious actors could exploit excessive permissions to gain unauthorized access to resources.

Mistake number three: not monitoring and auditing managed identity activity. Failing to monitor and audit managed identity usage can make it difficult to detect and respond to security incidents.

Mistake number four: not rotating credentials regularly. Failing to rotate credentials can increase the risk of a credential compromise, as static credentials can be exploited by malicious actors.

Mistake number five: not testing and validating managed identity configurations. Failing to test and validate managed identity configurations can lead to errors and security vulnerabilities.

To fix these mistakes, follow the best practices outlined earlier, and take the time to thoroughly test and validate managed identity configurations.

• Not enabling Managed Identities on supported services
• Assigning overly broad permissions to managed identities
• Not monitoring and auditing managed identity activity
• Not rotating credentials regularly
• Not testing and validating managed identity configurations

AZ-104 Exam Tips

When preparing for the AZ-104 exam, keep the following key points in mind:

First, understand the basics of Managed Identities, including how they work, the different types of managed identities, and how to enable them on supported services.

Second, know how to configure and manage managed identities, including how to assign permissions, monitor and audit activity, and rotate credentials.

Third, be familiar with common use cases and scenarios, such as using managed identities with Azure Storage, Azure Cosmos DB, and Azure Key Vault.

Fourth, understand the security benefits and considerations of using managed identities, including the principle of least privilege, monitoring and auditing, and credential rotation.

Fifth, practice with the Azure CLI and Azure SDKs to gain hands-on experience with managed identities and to prepare for the types of questions you may encounter on the exam.

Typical exam question styles may include:

• Multiple-choice questions that test your knowledge of managed identity basics and configuration
• Case study questions that require you to apply managed identity concepts to real-world scenarios
• Hands-on lab questions that test your ability to configure and manage managed identities using the Azure CLI and Azure SDKs

Gotchas to watch out for include:

• Confusing managed identities with service principals or other types of identities
• Not understanding the differences between system-assigned and user-assigned managed identities
• Not recognizing the security benefits and considerations of using managed identities

Summary and Next Steps

In this post, we covered the basics of Managed Identities in Azure, including how they work, the different types of managed identities, and how to enable them on supported services.

We also explored real-world use cases, best practices, and common mistakes to avoid, as well as provided tips and guidance for the AZ-104 exam.

To continue your learning journey, we recommend exploring the following topics in more depth:

• Azure Active Directory (AAD) and its role in managed identities
• Azure Policy and its application to managed identities
• Azure Security Center and its integration with managed identities

Stay tuned for the next post in this series, where we’ll dive into more advanced topics and scenarios related to Managed Identities in Azure.

  Next steps:
  1. Review Azure documentation on Managed Identities
  2. Practice with the Azure CLI and Azure SDKs
  3. Explore Azure Active Directory (AAD) and its role in managed identities

By following these next steps and continuing to learn about Managed Identities in Azure, you’ll be well on your way to becoming an expert in this critical area of Azure security and management.

Please refer previous blog of this series: Part 13