You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/spring-cloud/how-to-enable-system-assigned-managed-identity.md
+26-14Lines changed: 26 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: karlerickson
6
6
ms.author: xiading
7
7
ms.service: spring-cloud
8
8
ms.topic: how-to
9
-
ms.date: 02/09/2022
9
+
ms.date: 04/15/2022
10
10
ms.custom: devx-track-java, devx-track-azurecli
11
11
zone_pivot_groups: spring-cloud-tier-selection
12
12
---
@@ -26,22 +26,24 @@ If you're unfamiliar with managed identities for Azure resources, see the [Manag
26
26
::: zone pivot="sc-enterprise-tier"
27
27
28
28
- An already provisioned Azure Spring Cloud Enterprise tier instance. For more information, see [Quickstart: Provision an Azure Spring Cloud service instance using the Enterprise tier](quickstart-provision-service-instance-enterprise.md).
29
-
-[Azure CLI version 2.0.67 or later](/cli/azure/install-azure-cli).
- An already provisioned Azure Spring Cloud instance. For more information, see [Quickstart: Deploy your first application to Azure Spring Cloud](./quickstart.md).
37
+
-[Azure CLI version 2.30.0 or higher](/cli/azure/install-azure-cli).
Creating an app with a system-assigned identity requires setting an additional property on the application.
43
45
44
-
# [Portal](#tab/azure-portal)
46
+
###[Portal](#tab/azure-portal)
45
47
46
48
To set up a managed identity in the portal, first create an app, and then enable the feature.
47
49
@@ -50,13 +52,13 @@ To set up a managed identity in the portal, first create an app, and then enable
50
52
3. Select **Identity**.
51
53
4. Within the **System assigned** tab, switch **Status** to *On*. Select **Save**.
52
54
53
-
55
+
:::image type="content" source="media/enterprise/msi/msi-enable.png" alt-text="Azure portal screenshot showing the Identity screen for an application." lightbox="media/enterprise/msi/msi-enable.png":::
54
56
55
-
# [Azure CLI](#tab/azure-cli)
57
+
###[Azure CLI](#tab/azure-cli)
56
58
57
59
You can enable system-assigned managed identity during app creation or on an existing app.
58
60
59
-
**Enable system-assigned managed identity during creation of an app**
61
+
### Enable system-assigned managed identity during creation of an app
60
62
61
63
The following example creates an app named *app_name* with a system-assigned managed identity, as requested by the `--assign-identity` parameter.
62
64
@@ -65,18 +67,19 @@ az spring-cloud app create \
65
67
--resource-group <resource-group-name> \
66
68
--name <app-name> \
67
69
--service <service-instance-name> \
68
-
--assign-identity
70
+
--system-assigned
69
71
```
70
72
71
-
**Enable system-assigned managed identity on an existing app**
73
+
### Enable system-assigned managed identity on an existing app**
72
74
73
75
Use `az spring-cloud app identity assign` command to enable the system-assigned identity on an existing app.
74
76
75
77
```azurecli
76
78
az spring-cloud app identity assign \
77
79
--resource-group <resource-group-name> \
78
80
--name <app-name> \
79
-
--service <service-instance-name>
81
+
--service <service-instance-name> \
82
+
--system-assigned
80
83
```
81
84
82
85
---
@@ -93,25 +96,34 @@ Azure Spring Cloud shares the same endpoint for token acquisition with Azure Vir
93
96
94
97
Removing a system-assigned identity will also delete it from Azure AD. Deleting the app resource automatically removes system-assigned identities from Azure AD.
95
98
96
-
# [Portal](#tab/azure-portal)
99
+
###[Portal](#tab/azure-portal)
97
100
98
101
To remove system-assigned managed identity from an app that no longer needs it:
99
102
100
103
1. Sign in to the portal using an account associated with the Azure subscription that contains the Azure Spring Cloud instance.
101
104
1. Navigate to the desired application and select **Identity**.
102
105
1. Under **System assigned**/**Status**, select **Off** and then select **Save**:
:::image type="content" source="media/enterprise/msi/msi-disable.png" alt-text="Azure portal screenshot showing the Identity screen for an application, with the Status switch set to Off." lightbox="media/enterprise/msi/msi-disable.png":::
105
108
106
-
# [Azure CLI](#tab/azure-cli)
109
+
###[Azure CLI](#tab/azure-cli)
107
110
108
111
To remove system-assigned managed identity from an app that no longer needs it, use the following command:
109
112
110
113
```azurecli
111
114
az spring-cloud app identity remove \
112
115
--resource-group <resource-group-name> \
113
116
--name <app-name> \
114
-
--service <service-instance-name>
117
+
--service <service-instance-name> \
118
+
--system-assigned
119
+
```
120
+
121
+
## Get the client ID from the object ID (principal ID)
122
+
123
+
Use the following command to get the client ID from the object/principle ID value:
This article shows you how to use system-assigned and user-assigned managed identities for applications in Azure Spring Cloud.
19
+
20
+
Managed identities for Azure resources provide an automatically managed identity in Azure Active Directory (Azure AD) to an Azure resource such as your application in Azure Spring Cloud. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code.
21
+
22
+
## Feature status
23
+
24
+
| System-assigned | User-assigned |
25
+
| - | - |
26
+
| GA | Preview |
27
+
28
+
## Manage managed identity for an application
29
+
30
+
For system-assigned managed identities, see [How to enable and disable system-assigned managed identity](./how-to-enable-system-assigned-managed-identity.md).
31
+
32
+
For user-assigned managed identities, see [How to assign and remove user-assigned managed identities](./how-to-manage-user-assigned-managed-identities.md).
33
+
34
+
## Obtain tokens for Azure resources
35
+
36
+
An application can use its managed identity to get tokens to access other resources protected by Azure AD, such as Azure Key Vault. These tokens represent the application accessing the resource, not any specific user of the application.
37
+
38
+
You may need to configure the target resource to allow access from your application. For more information, see [Assign a managed identity access to a resource by using the Azure portal](../active-directory/managed-identities-azure-resources/howto-assign-access-portal.md). For example, if you request a token to access Key Vault, be sure you have added an access policy that includes your application's identity. Otherwise, your calls to Key Vault will be rejected, even if they include the token. To learn more about which resources support Azure Active Directory tokens, see [Azure services that support Azure AD authentication](../active-directory/managed-identities-azure-resources/services-azure-active-directory-support.md).
39
+
40
+
Azure Spring Cloud shares the same endpoint for token acquisition with Azure Virtual Machines. We recommend using Java SDK or Spring Boot starters to acquire a token. For various code and script examples and guidance on important topics such as handling token expiration and HTTP errors, see [How to use managed identities for Azure resources on an Azure VM to acquire an access token](../active-directory/managed-identities-azure-resources/how-to-use-vm-token.md).
41
+
42
+
## Examples of connecting Azure services in application code
43
+
44
+
The following table provides links to articles that contain examples:
| Key Vault |[Tutorial: Use a managed identity to connect Key Vault to an Azure Spring Cloud app](tutorial-managed-identities-key-vault.md)|
49
+
| Azure Functions |[Tutorial: Use a managed identity to invoke Azure Functions from an Azure Spring Cloud app](tutorial-managed-identities-functions.md)|
50
+
| Azure SQL |[Use a managed identity to connect Azure SQL Database to an Azure Spring Cloud app](connect-managed-identity-to-azure-sql.md)|
51
+
52
+
## Best practices when using managed identities
53
+
54
+
We highly recommend that you use system-assigned and user-assigned managed identities separately unless you have a valid use case. If you use both kinds of managed identity together, failure might happen if an application is using system-assigned managed identity and the application gets the token without specifying the client ID of that identity. This scenario may work fine until one or more user-assigned managed identities are assigned to that application, then the application may fail to get the correct token.
55
+
56
+
## Limitations
57
+
58
+
### Maximum number of user-assigned managed identities per application
59
+
60
+
For the maximum number of user-assigned managed identities per application, see [Quotas and Service Plans for Azure Spring Cloud](./quotas.md).
61
+
62
+
### Azure services that aren't supported
63
+
64
+
The following services do not currently support managed identity-based access:
65
+
66
+
- Azure Redis Cache
67
+
- Azure Flexible MySQL
68
+
- Azure Flexible PostgreSQL
69
+
- Azure Database for MariaDB
70
+
- Azure Cosmos DB - Mongo DB
71
+
- Azure Cosmos DB - Cassandra
72
+
- Azure Databricks
73
+
74
+
---
75
+
76
+
## Concept mapping
77
+
78
+
The following table shows the mappings between concepts in Managed Identity scope and Azure AD scope:
79
+
80
+
| Managed Identity scope | Azure AD scope |
81
+
|------------------------|----------------|
82
+
| Principal ID | Object ID |
83
+
| Client ID | Application ID |
84
+
85
+
## Next steps
86
+
87
+
-[Access Azure Key Vault with managed identities in Spring boot starter](https://github.com/Azure/azure-sdk-for-java/blob/master/sdk/spring/azure-spring-boot-starter-keyvault-secrets/README.md#use-msi--managed-identities)
88
+
-[Learn more about managed identities for Azure resources](https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/active-directory/managed-identities-azure-resources/overview.md)
89
+
-[How to use managed identities with Java SDK](https://github.com/Azure-Samples/Azure-Spring-Cloud-Samples)
All Azure services set default limits and quotas for resources and features. Azure Spring Cloud offers two pricing tiers: Basic and Standard. We will detail limits for both tiers in this article.
18
+
All Azure services set default limits and quotas for resources and features. Azure Spring Cloud offers two pricing tiers: Basic and Standard. We will detail limits for both tiers in this article.
0 commit comments