Azure Managed Identity Explained with Real-World Examples

Introduction

One of the biggest challenges in cloud application development is managing credentials securely. Applications often need to access services such as databases, storage accounts, Key Vaults, messaging services, and APIs. Traditionally, developers store connection strings, passwords, client secrets, or certificates inside configuration files.

While this approach works, it introduces security risks. Secrets can accidentally be exposed in source code repositories, deployment pipelines, configuration files, or logs.

To solve this problem, Microsoft Azure introduced Managed Identity, a feature that allows Azure resources to authenticate with other Azure services without storing credentials in application code.

In this article, you'll learn what Azure Managed Identity is, how it works, why it's important, and how to use it with real-world examples.

What Is Azure Managed Identity?

Azure Managed Identity is a feature that automatically creates and manages an identity in Microsoft Entra ID (formerly Azure Active Directory) for Azure resources.

This identity can be used to authenticate securely with other Azure services.

The key advantage is that developers no longer need to manage:

Passwords
Client secrets
Certificates
Connection credentials

Azure handles the authentication process automatically.

Think of Managed Identity as a company-issued ID card.

Instead of carrying multiple passwords for different departments, an employee uses a single company ID card to access authorized resources.

Managed Identity works in a similar way for Azure resources.

Why Do We Need Managed Identity?

Consider a typical ASP.NET Core application.

The application needs access to:

Azure SQL Database
Azure Storage Account
Azure Key Vault

Traditional configuration:

{
  "ConnectionString": "Server=myserver;User Id=admin;Password=secret123"
}

Problems:

Passwords may expire.
Secrets can leak.
Rotating credentials becomes difficult.
Security compliance becomes harder.

Managed Identity removes these concerns entirely.

The application authenticates without storing any credentials.

How Managed Identity Works

The authentication process is simple.

ASP.NET Core App
        ↓
Managed Identity
        ↓
Microsoft Entra ID
        ↓
Azure Resource
        ↓
Access Granted

The application requests a token.

Azure verifies the identity.

A secure access token is returned.

The application uses the token to access Azure resources.

No passwords are required.

Types of Managed Identity

Azure supports two types of Managed Identities.

System-Assigned Managed Identity

A system-assigned identity is tied directly to an Azure resource.

Examples:

Azure App Service
Azure Virtual Machine
Azure Functions
Azure Container Apps

Characteristics:

Automatically created
Automatically deleted with the resource
One identity per resource

User-Assigned Managed Identity

A user-assigned identity is created independently.

Characteristics:

Shared across multiple resources
Managed separately
Can be reused

Real-World Example

Suppose your company has:

Five Web Apps
Three Azure Functions
Two Container Apps

Instead of creating separate identities for each resource, you can create one user-assigned identity and share it across all applications.

This simplifies management considerably.

System-Assigned vs User-Assigned Identity

Feature	System-Assigned	User-Assigned
Lifecycle	Tied to Resource	Independent
Reusable	No	Yes
Management	Simple	More Flexible
Multiple Resources	Not Supported	Supported
Best For	Single Application	Multiple Applications

Enabling System-Assigned Managed Identity

Let's enable Managed Identity for an Azure App Service.

Navigate to:

Azure Portal
    → App Service
    → Identity

Enable:

System Assigned = On

Save changes.

Azure automatically creates an identity.

Example output:

Principal ID:
8a8f9f88-xxxx-xxxx-xxxx-xxxxxxxxxxxx

This identity now exists in Microsoft Entra ID.

Granting Permissions

Creating a Managed Identity alone isn't enough.

The identity must receive permission to access resources.

Example:

Suppose an application needs access to Azure Storage.

Navigate to:

Storage Account
    → Access Control (IAM)

Assign role:

Storage Blob Data Contributor

Select:

Managed Identity

Choose your application identity.

Save.

The application can now access blob storage securely.

Using Managed Identity in ASP.NET Core

Install the required package.

dotnet add package Azure.Identity

This package allows applications to authenticate using Managed Identity.

Accessing Azure Key Vault

One of the most common use cases is Azure Key Vault.

Traditional approach:

var secret = configuration["DatabasePassword"];

This requires storing secrets.

With Managed Identity:

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

var client = new SecretClient(
    new Uri("https://myvault.vault.azure.net/"),
    new DefaultAzureCredential());

var secret = await client.GetSecretAsync("DatabasePassword");

No password is stored in configuration files.

Azure automatically authenticates the application.

Understanding DefaultAzureCredential

Developers often encounter this class.

new DefaultAzureCredential()

This class automatically determines the best authentication method.

During development:

Visual Studio Login
        ↓
Azure CLI Login
        ↓
Developer Account

In Azure:

Managed Identity
        ↓
Azure Authentication

The same code works in both environments.

This makes development and deployment much easier.

Using Managed Identity with Azure Storage

Suppose your application uploads files to Blob Storage.

Traditional approach:

var connectionString =
    configuration.GetConnectionString("Storage");

Managed Identity approach:

using Azure.Identity;
using Azure.Storage.Blobs;

var blobClient = new BlobServiceClient(
    new Uri("https://mystorage.blob.core.windows.net"),
    new DefaultAzureCredential());

Azure handles authentication automatically.

No connection string is required.

Using Managed Identity with Azure SQL Database

Managed Identity can also access Azure SQL Database.

Connection string:

{
  "ConnectionStrings": {
    "DefaultConnection":
    "Server=myserver.database.windows.net;
     Database=SalesDb;
     Authentication=Active Directory Managed Identity"
  }
}

Authentication occurs automatically through the Managed Identity.

Benefits include:

No database passwords
Better security
Simplified credential management

Using Managed Identity with Azure Container Apps

Modern cloud-native applications often run inside Azure Container Apps.

Enable Managed Identity:

Container App
    → Identity
    → System Assigned
    → Enable

Your ASP.NET Core application can then access:

Key Vault
Storage Accounts
Azure SQL
Service Bus

Without storing secrets.

This is one of the most common enterprise scenarios today.

Real-World Scenario: E-Commerce Application

Imagine an online shopping platform.

The application uses:

Azure SQL Database
Azure Blob Storage
Azure Key Vault
Azure Service Bus

Without Managed Identity:

Database Password
Storage Key
Key Vault Secret
Service Bus Key

All credentials must be stored and maintained.

With Managed Identity:

Managed Identity
       ↓
Azure Authentication
       ↓
All Services

No secrets exist inside the application.

Security improves significantly.

Security Benefits

Managed Identity provides several security advantages.

No Hardcoded Secrets

Developers never store credentials in code.

Automatic Credential Rotation

Azure automatically manages credentials.

Reduced Attack Surface

Fewer exposed secrets means fewer security risks.

Compliance Support

Many security frameworks recommend eliminating stored credentials.

Examples:

ISO 27001
SOC 2
PCI DSS

Managed Identity helps organizations meet these requirements.

Common Mistakes Developers Make

Forgetting Role Assignments

Developers often enable Managed Identity but forget IAM permissions.

Result:

403 Forbidden

Always assign the appropriate role.

Using Connection Strings Unnecessarily

Many developers continue storing secrets even after enabling Managed Identity.

Instead:

Use:

DefaultAzureCredential

Avoid:

StorageConnectionString

Testing Only in Azure

Always test locally using Azure CLI or Visual Studio authentication.

This ensures smooth deployments.

Best Practices

When using Managed Identity:

Prefer Managed Identity over client secrets.
Follow least-privilege access principles.
Use Azure RBAC roles.
Store sensitive information in Key Vault.
Avoid hardcoded credentials.
Use User-Assigned Identities when sharing access.
Monitor identity usage regularly.

These practices improve security and maintainability.

Advantages of Managed Identity

Managed Identity offers numerous benefits.

No password management
Improved security
Automatic credential rotation
Easier deployments
Better compliance support
Reduced operational overhead
Simplified cloud architecture
Strong Azure integration

These benefits become more significant as applications grow.

Conclusion

Azure Managed Identity is one of the most valuable security features available in Azure today. It eliminates the need to store passwords, client secrets, and connection strings inside applications while providing secure and seamless authentication to Azure resources.

Whether you're building ASP.NET Core APIs, Azure Functions, Container Apps, microservices, or enterprise cloud solutions, Managed Identity helps improve security, simplify authentication, and reduce operational complexity.

By combining Managed Identity with services such as Azure Key Vault, Azure Storage, Azure SQL Database, and Azure Service Bus, developers can build modern cloud-native applications that are both secure and easier to maintain.

As organizations continue adopting cloud-first architectures, Azure Managed Identity has become an essential best practice for secure application development.