Workloads need identities too, and the safest credential is one you never handle. Managed identities give Azure compute an identity whose secret the platform manages, while service principals remain for code that runs outside Azure.
| Identity | Lifecycle and sharing | Pick when |
|---|---|---|
| System-assigned managed identity | Created and deleted with one resource, so ten VMs get ten identities | Credentials must be tied to a single service instance |
| User-assigned managed identity | A standalone resource that can be attached to many resources. Grant its roles once | A growing set of VMs or apps must share one identity with no new role assignments |
| Service principal (app registration with a secret or certificate) | The credential must be stored and rotated, and can be copied | Code running outside Azure, for example a Databricks service principal for on-premises apps |
Common trap: Choosing a service principal when credentials must be tied to one service instance — its secret can be copied and shared; use a system-assigned managed identity.
Common trap: Choosing system-assigned identities for an app that runs across several VMs — that creates one identity per VM, each needing its own role assignments; use a user-assigned identity.
How managed identities authenticate
Figure 1.3 traces the token request step by step.
- Managed identities keep no secrets on the VM and can authenticate only from compute they are attached to. The same applies on Linux.
- A managed identity is app-only, which corresponds to the OAuth 2.0 client credentials grant.
- Code on a VM gets managed-identity tokens from the Azure Instance Metadata Service (IMDS):
- Endpoint:
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net, with the headerMetadata: true. - The address is non-routable and reachable only from inside the VM.
- DefaultAzureCredential wraps this call.
- Endpoint:
- The Microsoft identity platform endpoint (
login.microsoftonline.com) is for app registrations that authenticate with their own secret or certificate.
Common trap: Requesting a VM’s managed-identity token from the Microsoft identity platform (Entra ID token endpoint) — managed-identity tokens come from IMDS on the VM.
Databricks credentials
For Databricks, personal access tokens belong to individual users and must be replaced when staff leave. Managed identities work only for code running on Azure, which is why on-premises callers use a Databricks service principal.