Do you use Managed Identities in your Azure projects?

Teams often unknowingly create security risks by storing secrets in configuration files, DevOps variables, or - even worse - accidentally committing them to Git 😱. This leads to production outages, broken deployments, and painful key rotations that waste time and cost money. Even when Key Vault is used, many rely on static secrets, which still require manual rotation and management. Thankfully Azure has a much safer way of solving this problem.

How to use Managed Identity in your project

What is a Managed Identity?

A Managed Identity is an identity that Azure creates and manages for your resource so it can authenticate securely without storing any credentials.

Azure automatically handles:

• Password and secret rotation
• Identity lifecycle
• Secure authentication to Azure services

This means no more stored secrets, ever.

📚 Learn more - Microsoft official documentation

Why Managed Identity is always better

Using secrets (even when placed in Key Vault as static keys) creates manual work and security gaps. Managed Identity removes that entire problem space.

✅ Benefits

• Eliminates all secrets and keys
• More secure – nothing to leak
• Supported by all Azure SDKs
• Automatically rotates
• Free

System-assigned vs user-assigned Managed Identity

System-assigned

A system-assigned managed identity belongs to a single Azure resource. It is created with that resource and deleted when the resource is deleted.

Example:

• App Service A needs to read secrets from Key Vault A
• Grant App Service A’s managed identity the Key Vault Secrets User role on Key Vault A

When to use it

👉 Use this for the simplest case: one app, one identity, one target resource.

User-assigned

A user-assigned managed identity is a separate Azure resource. It can be attached to multiple Azure resources and reused across them.

Example:

• App Service A and App Service B both need to read secrets from Key Vault A
• Create User-assigned Managed Identity A
• Attach it to App Service A and App Service B
• Grant User-assigned Managed Identity A the Key Vault Secrets User role on Key Vault A

When to use it

👉 Use this when multiple apps need the same identity and the same permissions.

Code example – Connect to Azure App Configuration using Managed Identity

Example from the video:

var appConfigEndpoint =
    builder.Configuration["AppConfig:Endpoint"]
    ?? throw new InvalidOperationException("App Configuration endpoint not set");

var clientId =
    builder.Configuration["ManagedIdentity:ClientId"]
    ?? throw new InvalidOperationException("Managed Identity client ID not set");

builder.Configuration.AddAzureAppConfiguration(options =>
{
    options.Connect(
        new Uri(appConfigEndpoint),
        new DefaultAzureCredential(
            new DefaultAzureCredentialOptions
            {
                ManagedIdentityClientId = clientId
            }));
});