{"id":3526,"date":"2017-09-14T00:00:00","date_gmt":"2017-09-14T00:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/blog\/keep-credentials-out-of-code-introducing-azure-ad-managed-service-identity"},"modified":"2025-06-25T04:31:05","modified_gmt":"2025-06-25T11:31:05","slug":"keep-credentials-out-of-code-introducing-azure-ad-managed-service-identity","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/keep-credentials-out-of-code-introducing-azure-ad-managed-service-identity\/","title":{"rendered":"Keep credentials out of code: Introducing Azure AD Managed Service Identity"},"content":{"rendered":"\n

A common challenge in cloud development is managing the credentials used to authenticate to cloud services. Today, I am happy to announce the Azure Active Directory Managed Service Identity<\/a> (MSI) preview. MSI gives your code an automatically managed identity for authenticating to Azure services, so that you can keep credentials out of your code.<\/p>\n\n\n\n

What is Managed Service Identity and how do I use it?<\/h2>\n\n\n\n

Your code needs credentials to authenticate to cloud services, but you want to limit the visibility of those credentials as much as possible. Ideally, they never appear on a developer\u2019s workstation or get checked-in to source control. Azure Key Vault<\/a> can store credentials securely so they aren\u2019t in your code, but to retrieve them you need to authenticate to Azure Key Vault. To authenticate to Key Vault, you need a credential! A classic bootstrap problem. Through the magic of Azure and Azure AD, MSI provides a \u201cbootstrap identity\u201d that makes it much simpler to get things started.<\/p>\n\n\n\n

Here\u2019s how it works! When you enable MSI for an Azure service such as Virtual Machines, App Service, or Functions, Azure creates a Service Principal for the instance of the service in Azure AD, and injects the credentials (client ID and certificate) for the Service Principal into the instance of the service. Next,<\/p>\n\n\n\n

    \n
  1. Your code calls a local MSI endpoint to get an access token<\/li>\n\n\n\n
  2. MSI uses the locally injected credentials to get an access token from Azure AD<\/li>\n\n\n\n
  3. Your code uses this access token to authenticate to an Azure service<\/li>\n<\/ol>\n\n\n\n
    \"Azure<\/figure>\n\n\n\n

    And that\u2019s it! The access token can be used directly with a service that supports Azure AD authentication, such as Azure Resource Manager. If you need to authenticate to a service that doesn\u2019t natively support Azure AD, you can use the token to authenticate to Key Vault and retrieve credentials from there. Azure and Azure AD take care of rolling the Service Principal\u2019s credentials. Your code and your developers will never see or manage them.<\/p>\n\n\n\n

    Try it<\/h2>\n\n\n\n

    Today we are announcing previews of Managed Service Identity for:<\/p>\n\n\n\n