Managed Identity

Overview

We replace connection strings and client secrets between Azure services with managed identities. System-assigned or user-assigned is chosen from whether several resources must share one identity, and each identity is granted the smallest role on the target.

We update Data Factory, Functions, Container Apps, and virtual machines that still use keys, and we remove the old secret once the new path has been tested. A table lists every identity and the resource it may call.

What we deliver

• User-assigned or system-assigned identities for each workload
• Role assignments limited to the target resource and action
• Pipeline, function, and app config moved off stored secrets
• A register of identities and the resources they can reach

Business benefits

• Services authenticate without a password to rotate
• A compromised config file no longer contains a storage key
• You can see which workload is allowed to read which account