About the delivery
ProsessPilotene delivered Managed Identity for GC Rieber AS (2025).
Value creation
Lower risk - no client secret that could fall into the wrong hands
Less maintenance - no manual key rotation
The solutions
- Managed Identity
Managed Identity: Microsoft Managed Identity works by having Azure automatically create and manage an identity in Microsoft Entra ID for an Azure resource, such as a virtual machine or App Service. This identity is then used to authenticate and access other Azure services without having to manage secrets such as passwords or keys in the code. There are two types: system-assigned (tied to the resource's lifecycle) and user-assigned (can be shared across multiple resources).
Brief summary of the feature
- Azure associates an identity with a resource (VM, app, etc.).
- Applications on this resource can retrieve tokens from Azure Instance Metadata Service without secrets.
- Tokens are used to securely access other services (e.g., Key Vault, Storage).
- Azure automatically handles credential rotation behind the scenes.
Benefits of Managed Identity vs. Service Principal
Managed Identity advantages Managed Identity disadvantages Service Principal advantages Service Principal disadvantages
No need to manage secrets Only for Azure resources Can be used outside Azure (hybrid/multi-cloud) Requires manual management of secrets
Automatic credential rotation Does not support cross-tenant scenarios without a workaround Supports cross-tenant and a wide range of scenarios Increased risk if secrets are leaked
Lifecycle tied to the resource (automatic deletion) Less flexible outside the Azure environment More flexible for automation and external use Requires additional security protocols
Simplifies the securing of Azure services Fine-grained access can be granted through multiple identities More complex in terms of security management
In summary, Managed Identity provides a simpler, more secure, and more automated way to authenticate Azure resources with other Azure services, while service principals are still required in more complex or hybrid scenarios outside Azure
Area and keywords
Backend
Application User,Client Secret
Limitations
Some limitations of using Microsoft Managed Identities in Azure are:
- Changes to access permissions (roles and groups) may take several hours to take effect because tokens are cached for up to 24 hours in the Azure infrastructure. It is not possible to force an early token refresh.
- Managed identities only work within the Azure environment and do not support scenarios such as cross-tenant (between different Azure AD tenants).
- They cannot be moved between different resource groups or subscriptions; new identities must be created and the necessary permissions reassigned when moving.
- Managed identities are not supported in Azure Cloud Services (classic) environments.
- There are rate-limiting restrictions for requests to the Instance Metadata Service that handles token access (for example, a maximum of 5 requests per second, with some variation by category).
- When a managed identity is deleted, existing tokens will remain valid until they expire, but new tokens cannot be requested.
These limitations make managed identities best suited to Azure-native applications and services requiring high security and simple user management, but less suitable for complex hybrid or multi-tenant scenarios.