Implement Managed Identities for Azure resources

Managed Identities for Azure resources provide a secure and effortless way to manage access to various Azure services. With managed identities, you don’t need to store any credentials or secrets in your code or configuration files. In this article, we will explore how to implement managed identities for Azure resources to enhance security and ease management tasks.

Understanding Managed Identities

Managed identities for Azure resources are automatically managed within Azure Active Directory (Azure AD). They act as service principals, allowing your resources to authenticate and access other Azure resources securely. Managed identities can be assigned to services like Virtual Machines (VMs), App Service, Azure Functions, and more.

There are two types of managed identities:

• System-assigned managed identity: The managed identity is enabled directly on an Azure resource. Azure automatically creates and associates the identity with the resource. When the resource is deleted, the identity is also removed.
• User-assigned managed identity: The managed identity is created as a standalone Azure AD resource. You can assign the identity to one or more Azure resources. It allows multiple resources to share the same identity for authentication.

Enabling Managed Identities

Let’s see how we can enable managed identities for Azure resources.

System-assigned managed identity

To enable a system-assigned managed identity, follow these steps:

1. Create or select an Azure resource that supports system-assigned managed identities, such as a Virtual Machine.
2. In the resource’s configuration menu, locate the “Identity” section.

3. Toggle the switch to enable the system-assigned managed identity.
4. Save the changes to apply the identity to the resource.

User-assigned managed identity

To enable a user-assigned managed identity, follow these steps:

1. Create a new standalone user-assigned managed identity in Azure AD, or use an existing one.
2. Assign the managed identity to Azure resources that support user-assigned managed identities. For example, you can assign it to an App Service.

3. Save the changes to apply the identity assignment.

Configuring Access Control

Now that we have enabled managed identities, let’s explore how to configure access control for these identities.

Azure Resource Manager (ARM) access

To grant access to managed identities at the subscription or resource group level, follow these steps:

1. Open the Azure portal and navigate to the subscription or resource group.
2. In the “Access control (IAM)” menu, click on the “Add” button to add a new role assignment.

3. Select the desired role, such as “Contributor”, “Reader”, or a custom role.
4. Search for the managed identity by name or browse the directory.
5. Save the role assignment to grant the specified access to the managed identity.

Azure Key Vault access

To allow managed identities to access secrets stored in Azure Key Vault, follow these steps:

1. Open the Azure portal and navigate to the Azure Key Vault.
2. Select the “Access policies” menu.
3. Click on the “Add Access Policy” button to add a new access policy.

4. Configure the access policy by selecting the appropriate permissions and choosing the managed identity.
5. Save the access policy to grant the managed identity access to the Key Vault.

Authenticating with Managed Identities

Now that we have enabled and configured managed identities, let’s explore how to authenticate with them.

Azure SDK Authentication

When using Azure SDK libraries, such as the Azure Management Libraries, managed identities are automatically used for authentication. The SDK retrieves the identity information from the environment and securely authenticates the request to Azure resources.

Here’s an example of authenticating with a managed identity using the Azure SDK for .NET:

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

KeyVaultSecret secret = client.GetSecret("your-secret-name");
Console.WriteLine($"Secret value: {secret.Value}");

The DefaultAzureCredential class from the Azure.Identity library automatically authenticates using the managed identity associated with the environment.

REST API Authentication

When authenticating with managed identities using the REST API, you can retrieve an access token from the managed identity endpoint. The managed identity endpoint URL is based on the type of identity:

• For system-assigned managed identities, use http://169.254.169.254/metadata/identity/oauth2/token.
• For user-assigned managed identities, use https://managedidentity.azure.net/{identityId}/oauth2/token.

Make an HTTP request to the managed identity endpoint with the appropriate parameters to retrieve an access token. You can then use this access token to authenticate requests to other Azure services.

Conclusion

In this article, we explored how to implement managed identities for Azure resources. We learned about system-assigned and user-assigned managed identities, enabling them on resources, configuring access control, and authenticating with managed identities. By leveraging managed identities, you can enhance security, simplify access management, and eliminate the need for storing secrets or credentials in your code or configuration files.