Managed identity integration in Azure - Mini Project: Build & Apply

Managed Identity Integration in Azure

📖 Scenario: You are setting up an Azure Virtual Machine (VM) that needs to securely access Azure Key Vault without using passwords. To do this, you will enable a managed identity for the VM and grant it access to the Key Vault.

🎯 Goal: Enable a system-assigned managed identity on an Azure VM and configure an access policy on an Azure Key Vault to allow the VM to read secrets.

📋 What You'll Learn

Create an Azure Virtual Machine resource with system-assigned managed identity enabled.

Create an Azure Key Vault resource.

Add an access policy to the Key Vault granting the VM's managed identity permission to get secrets.

Use valid Azure Resource Manager (ARM) template JSON syntax.

💡 Why This Matters

🌍 Real World

Managed identities allow Azure resources to securely access other Azure services without storing credentials. This project shows how to set up this secure connection between a VM and Key Vault.

💼 Career

Understanding managed identity integration is essential for cloud engineers and architects to build secure, password-free authentication between Azure services.

1

Create Azure VM resource with system-assigned managed identity

Create an Azure Virtual Machine resource named myVM with the property identity set to enable systemAssigned managed identity.

Azure

{
  "type": "Microsoft.Compute/virtualMachines",
  "apiVersion": "2022-08-01",
  "name": "myVM",
  "location": "eastus",
  "identity": {
    // Enable systemAssigned managed identity here
  },
  "properties": {
    // VM properties here
  }
}

Hint

Set the identity property with "type": "SystemAssigned" to enable managed identity.

2

Create Azure Key Vault resource

Create an Azure Key Vault resource named myKeyVault in eastus location with sku name set to standard.

Azure

{
  "type": "Microsoft.Compute/virtualMachines",
  "apiVersion": "2022-08-01",
  "name": "myVM",
  "location": "eastus",
  "identity": {
    "type": "SystemAssigned"
  },
  "properties": {
    "hardwareProfile": {
      "vmSize": "Standard_DS1_v2"
    },
    "storageProfile": {
      "imageReference": {
        "publisher": "MicrosoftWindowsServer",
        "offer": "WindowsServer",
        "sku": "2019-Datacenter",
        "version": "latest"
      },
      "osDisk": {
        "createOption": "FromImage"
      }
    },
    "osProfile": {
      "computerName": "myVM",
      "adminUsername": "azureuser",
      "adminPassword": "Password1234!"
    },
    "networkProfile": {
      "networkInterfaces": [
        {
          "id": "[resourceId('Microsoft.Network/networkInterfaces', 'myVMNic')]"
        }
      ]
    }
  }
},
{
  // Create Key Vault resource here
}

Hint

Use "type": "Microsoft.KeyVault/vaults" and set sku.name to standard.

3

Add access policy to Key Vault for VM's managed identity

Add an access policy to myKeyVault granting the managed identity of myVM permission to get secrets. Use objectId from reference('myVM', '2022-08-01').identity.principalId and set permissions.secrets to ["get"].

Azure

{
  "type": "Microsoft.Compute/virtualMachines",
  "apiVersion": "2022-08-01",
  "name": "myVM",
  "location": "eastus",
  "identity": {
    "type": "SystemAssigned"
  },
  "properties": {
    "hardwareProfile": {
      "vmSize": "Standard_DS1_v2"
    },
    "storageProfile": {
      "imageReference": {
        "publisher": "MicrosoftWindowsServer",
        "offer": "WindowsServer",
        "sku": "2019-Datacenter",
        "version": "latest"
      },
      "osDisk": {
        "createOption": "FromImage"
      }
    },
    "osProfile": {
      "computerName": "myVM",
      "adminUsername": "azureuser",
      "adminPassword": "Password1234!"
    },
    "networkProfile": {
      "networkInterfaces": [
        {
          "id": "[resourceId('Microsoft.Network/networkInterfaces', 'myVMNic')]"
        }
      ]
    }
  }
},
{
  "type": "Microsoft.KeyVault/vaults",
  "apiVersion": "2022-07-01",
  "name": "myKeyVault",
  "location": "eastus",
  "properties": {
    "sku": {
      "family": "A",
      "name": "standard"
    },
    "tenantId": "[subscription().tenantId]",
    "accessPolicies": [
      {
        // Add access policy for VM's managed identity here
      }
    ]
  }
}

Hint

Use reference('myVM', '2022-08-01').identity.principalId for objectId and set permissions.secrets to ["get"].

4

Complete ARM template with resources array

Wrap the VM and Key Vault resource objects inside a resources array in a valid ARM template JSON structure with $schema, contentVersion, and parameters as empty object.

Azure

{
  // Wrap resources in ARM template structure here
  // Add $schema, contentVersion, parameters, and resources array
}

Hint

Wrap the VM and Key Vault objects inside a resources array and add $schema, contentVersion, and empty parameters.

Practice

1. What is the main purpose of using a managed identity in Azure?
Managed Identity helps your app to:

easy

A. Create new Azure subscriptions automatically

B. Access other Azure services securely without storing credentials

C. Run virtual machines faster

D. Manage user passwords in Azure Active Directory

Solution

1. Step 1: Understand managed identity purpose

   Managed identities provide apps a way to authenticate to Azure services without needing to store credentials like passwords.

2. Step 2: Identify correct use case

   Among the options, only accessing services securely without credentials matches the purpose of managed identities.

3. Final Answer:

   Access other Azure services securely without storing credentials -> Option B

4. Quick Check:

   Managed identity = secure access without passwords [OK]

Hint: Managed identity means no passwords needed for service access [OK]

Common Mistakes:

• Thinking managed identity speeds up VM performance
• Confusing managed identity with subscription management
• Assuming it manages user passwords

2. Which of the following is the correct way to enable a system-assigned managed identity for an Azure Virtual Machine using Azure CLI?

easy

A. az vm identity enable --name MyVM --resource-group MyGroup

B. az vm create --name MyVM --resource-group MyGroup --assign-identity

C. az vm identity assign --name MyVM --resource-group MyGroup

D. az vm identity add --name MyVM --resource-group MyGroup

Solution

1. Step 1: Recall Azure CLI command for managed identity

   The correct command to assign a system-assigned managed identity to an existing VM is az vm identity assign.

2. Step 2: Verify command syntax

   az vm identity assign --name MyVM --resource-group MyGroup uses the correct command and parameters. Other options use incorrect commands or flags.

3. Final Answer:

   az vm identity assign --name MyVM --resource-group MyGroup -> Option C

4. Quick Check:

   Assign identity command = az vm identity assign [OK]

Hint: Use 'az vm identity assign' to enable system-assigned identity [OK]

Common Mistakes:

• Using 'az vm create' with wrong flags
• Using non-existent commands like 'identity enable'
• Confusing 'assign' with 'add'

3. Consider this Azure CLI command sequence:

az vm create --name MyVM --resource-group MyGroup --image UbuntuLTS --assign-identity
az role assignment create --assignee  --role Reader --scope /subscriptions/123/resourceGroups/MyGroup

What is the expected result?

medium

A. The VM is created with a system-assigned identity and granted Reader role on the resource group

B. The VM is created without any identity and no role assignment is made

C. The VM creation fails due to missing identity parameters

D. The VM is created but the role assignment fails because the principal ID is invalid

Solution

1. Step 1: Analyze VM creation command

   The --assign-identity flag creates a system-assigned managed identity for the VM.

2. Step 2: Analyze role assignment command

   The role assignment grants the identity Reader access to the resource group scope using the identity's principal ID.

3. Final Answer:

   The VM is created with a system-assigned identity and granted Reader role on the resource group -> Option A

4. Quick Check:

   Assign identity + role assignment = secure access granted [OK]

Hint: Assign identity then grant role for access [OK]

Common Mistakes:

• Assuming VM creation fails without explicit identity creation
• Thinking role assignment needs user principal, not identity
• Ignoring the --assign-identity flag effect

4. You tried to enable a user-assigned managed identity on an Azure App Service but received an error. Which of the following is the most likely cause?

medium

A. The App Service plan is not Premium tier

B. The App Service already has a system-assigned identity enabled

C. The user-assigned identity was not created in the same subscription

D. The user-assigned identity is not assigned to the App Service resource

Solution

1. Step 1: Understand user-assigned identity attachment

   User-assigned identities must be explicitly assigned to the resource to be used.

2. Step 2: Identify common error cause

   If the identity exists but is not assigned to the App Service, enabling it will fail.

3. Final Answer:

   The user-assigned identity is not assigned to the App Service resource -> Option D

4. Quick Check:

   User-assigned identity must be assigned to resource [OK]

Hint: Assign user identity to resource before enabling [OK]

Common Mistakes:

• Assuming system-assigned identity conflicts with user-assigned
• Thinking subscription mismatch causes error
• Believing App Service plan tier affects identity assignment

5. You want an Azure Function to access a Key Vault securely using a managed identity. Which steps should you follow to set this up correctly?

hard

A. Enable system-assigned identity on the Function, grant it Key Vault access policy, then use identity in code

B. Create a user-assigned identity, assign it to the Function, then store its secret in Key Vault

C. Enable system-assigned identity on the Function, store Function credentials in Key Vault, then access Key Vault

D. Create a user-assigned identity, assign it to the Function, then use a password stored in Key Vault

Solution

1. Step 1: Enable system-assigned managed identity on Azure Function

   This allows the Function to authenticate without credentials.

2. Step 2: Grant the Function's identity access to Key Vault

   Set an access policy in Key Vault to allow the identity to read secrets.

3. Step 3: Use the managed identity in Function code to access Key Vault

   The Function can request tokens and securely retrieve secrets without passwords.

4. Final Answer:

   Enable system-assigned identity on the Function, grant it Key Vault access policy, then use identity in code -> Option A

5. Quick Check:

   Enable identity + grant access + use identity = secure Key Vault access [OK]

Hint: Enable identity, grant access, then use it in code [OK]

Common Mistakes:

• Storing passwords instead of using managed identity
• Confusing user-assigned identity with storing secrets
• Not granting Key Vault access to the identity