Architecting Microsoft Azure Solutions: Exam Guide 70-535

Azure Active Directory Managed Service Identity

Azure Active Directory Managed Service Identity is, by the time of writing this book, still in preview. It offers a managed identity for all resources in Azure that are using Azure Active Directory.

When you enable MSI on your Azure resource, such as an Azure Virtual Machine, Azure Function, or App, Azure will create a Service Principal and stores the credentials of that Service Principal on to the Azure resource itself. When it is time to authenticate, an MSI endpoint is called, passing your current Azure AD credentials and a reference to the specific resource. MSI then retrieves the stored credentials from the Azure resource, passes it to Azure AD, and retrieves an access token that can be ...