Skip to content

Commit 1d42c61

Browse files
committed
User-assigned identity flow
1 parent 63cc683 commit 1d42c61

File tree

8 files changed

+148
-7
lines changed

8 files changed

+148
-7
lines changed

.openpublishing.redirection.azure.json

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,10 @@
127127
{
128128
"source_path_from_root": "/docs/azure/sdk/authentication/authentication-best-practices.md",
129129
"redirect_url": "/dotnet/azure/sdk/authentication/best-practices"
130+
},
131+
{
132+
"source_path_from_root": "/dotnet/azure/sdk/authentication/azure-hosted-apps.md",
133+
"redirect_url": "/dotnet/azure/sdk/authentication/system-assigned-managed-identity"
130134
}
131135
]
132136
}

docs/azure/TOC.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,11 @@
6666
- name: Auth using developer accounts
6767
href: ./sdk/authentication/local-development-dev-accounts.md
6868
- name: Auth from Azure-hosted apps
69-
href: ./sdk/authentication/azure-hosted-apps.md
69+
items:
70+
- name: Use a system-assigned managed identity
71+
href: ./sdk/authentication/system-assigned-managed-identity.md
72+
- name: Use a user-assigned managed identity
73+
href: ./sdk/authentication/user-assigned-managed-identity.md
7074
- name: Auth from on-premises apps
7175
href: ./sdk/authentication/on-premises-apps.md
7276
- name: Auth via configuration files

docs/azure/sdk/authentication/azure-hosted-apps.md renamed to docs/azure/sdk/authentication/system-assigned-managed-identity.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
---
2-
title: Authenticate Azure-hosted .NET apps to Azure resources
3-
description: Learn how to authenticate apps to Azure services when hosted in an Azure compute service like Azure App Service, Azure Functions, or Azure Virtual Machines.
2+
title: Authenticate Azure-hosted .NET apps to Azure resources using a system-assigned managed identity
3+
description: Learn how to authenticate Azure-hosted .NET apps to other Azure services using a system-assigned identity
44
ms.topic: how-to
55
ms.custom: devx-track-dotnet, engagement-fy23, devx-track-azurecli
66
ms.date: 02/06/2025
77
---
88

9-
# Authenticate Azure-hosted apps to Azure resources with the Azure SDK for .NET
9+
# Authenticate Azure-hosted .NET apps to Azure resources using a system-assigned managed identity
1010

1111
The recommended approach to authenticate an Azure-hosted app to other Azure resources is to use a [managed identity](/entra/identity/managed-identities-azure-resources/overview). This approach is [supported for most Azure services](/entra/identity/managed-identities-azure-resources/managed-identities-status), including apps hosted on Azure App Service, Azure Container Apps, and Azure Virtual Machines. Discover more about different authentication techniques and approaches on the [authentication overview](/dotnet/azure/sdk/authentication) page. In the sections ahead, you'll learn:
1212

1313
- Essential managed identity concepts
14-
- How to create a managed identity for your app
15-
- How to assign roles to the managed identity
16-
- How to authenticate using the managed identity from your app code
14+
- How to create a system-assigned managed identity for your app
15+
- How to assign roles to the system-assigned managed identity
16+
- How to authenticate using the system-assigned managed identity from your app code
1717

1818
## Essential managed identity concepts
1919

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
title: Authenticate Azure-hosted .NET apps to Azure resources using a user-assigned managed identity
3+
description: Learn how to authenticate Azure-hosted .NET apps to other Azure services using a user-assigned identity
4+
ms.topic: how-to
5+
ms.custom: devx-track-dotnet, engagement-fy23, devx-track-azurecli
6+
ms.date: 02/06/2025
7+
---
8+
9+
# Authenticate Azure-hosted .NET apps to Azure resources using a user-assigned managed identity
10+
11+
The recommended approach to authenticate an Azure-hosted app to other Azure resources is to use a [managed identity](/entra/identity/managed-identities-azure-resources/overview). This approach is [supported for most Azure services](/entra/identity/managed-identities-azure-resources/managed-identities-status), including apps hosted on Azure App Service, Azure Container Apps, and Azure Virtual Machines. Discover more about different authentication techniques and approaches on the [authentication overview](/dotnet/azure/sdk/authentication) page. In the sections ahead, you'll learn:
12+
13+
- Essential managed identity concepts
14+
- How to create a user-assigned managed identity for your app
15+
- How to assign roles to the user-assigned managed identity
16+
- How to authenticate using the user-assigned managed identity from your app code
17+
18+
[!INCLUDE [managed-identity-concepts](../includes/managed-identity-concepts.md)]
19+
20+
## Create a user-assigned managed identity
21+
22+
User-assigned identities are created as standalone resources in your Azure subscription. You can create them using the Azure portal or the Azure CLI.
23+
24+
### [Azure portal](#tab/azure-portal)
25+
26+
1. In the Azure portal, enter *Managed identities* in the main search bar and select the matching result under the **Services** section.
27+
1. On the **Managed Identities** page, select **+ Create**.
28+
29+
:::image type="content" source="../media/user-assigned-identity-create.png" alt-text="A screenshot showing the page to manage user-assigned identities.":::
30+
31+
1. On the **Create User Assigned Managed Identity** page, select a subscription, resource group, and region for the user-assigned identity. Enter a logical name for the identity.
32+
1. Select **Review + create** to review and validate your inputs.
33+
34+
:::image type="content" source="../media/user-assigned-identity-form.png" alt-text="A screenshot showing the form to create a user-assigned identity.":::
35+
36+
1. Select **Create** to create the user-assigned identity.
37+
38+
### [Azure CLI](#tab/azure-cli)
39+
40+
Azure CLI commands can be run in the [Azure Cloud Shell](https://shell.azure.com) or on a workstation with the [Azure CLI installed](/cli/azure/install-azure-cli).
41+
42+
The Azure CLI commands used to enable managed identity for an Azure resource are of the form `az <command-group> identity --resource-group <resource-group-name> --name <resource-name>`. Specific commands for popular Azure services are shown below.
43+
44+
```azurecli
45+
az identity create --resource-group <resource-group-name> --name <identity-name>
46+
```
47+
48+
The command output should display the following values:
49+
- **ClientID**: Used to configure application code that uses the identity.
50+
- **Location**: The Azure region that contains the identity.
51+
- **Name**: The name of the identity.
52+
- **PrincipalId**: Used for access control and role assignments in Azure.
53+
- **ResourceGroup**: The resource group that contains the identity.
54+
- **TenantId**: The Microsoft Entra tenant that contains the identity. in.
55+
56+
For the steps ahead, you'll use the `principalId` to assign roles to the managed identity.
57+
58+
[!INCLUDE [assign-roles-identity](../includes/assign-roles-identity.md)]
59+
60+
## Implement DefaultAzureCredential in your application
61+
62+
[!INCLUDE [Implement DefaultAzureCredential](<../includes/implement-defaultazurecredential.md>)]
Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
## Assign roles to the managed identity
2+
3+
Next, determine which roles your app needs and assign those roles to the managed identity. You can assign roles to a managed identity at the following scopes:
4+
5+
- **Resource**: The assigned roles only apply to that specific resource.
6+
- **Resource group**: The assigned roles apply to all resources contained in the resource group.
7+
- **Subscription**: The assigned roles apply to all resources contained in the subscription.
8+
9+
The following example shows how to assign roles at the resource group scope, since many apps manage all their related Azure resources using a single resource group.
10+
11+
### [Azure portal](#tab/azure-portal)
12+
13+
1. Navigate to the **Overview** page of the resource group that contains the app with the system-assigned managed identity.
14+
1. Select **Access control (IAM)** on the left navigation.
15+
1. On the **Access control (IAM)** page, select **+ Add** on the top menu and then choose **Add role assignment** to navigate to the **Add role assignment** page.
16+
17+
:::image type="content" source="../media/system-assigned-identity-access-control.png" alt-text="A screenshot showing how to access the identity role assignment page.":::
18+
19+
1. The **Add role assignment** page presents a tabbed, multi-step workflow to assign roles to identities. On the initial **Role** tab, use the search box at the top to locate the role you want to assign to the identity.
20+
1. Select the role from the results and then choose **Next** to move to the **Members** tab.
21+
1. For the **Assign access to** option, select **Managed identity**.
22+
1. For the **Members** option, choose **+ Select members** to open the **Select managed identities** panel.
23+
1. On the **Select managed identities** panel, use the **Subscription** and **Managed identity** dropdowns to filter the search results for your identities. Use the **Select** search box to locate the system-identity you enabled for the Azure resource hosting your app.
24+
25+
:::image type="content" source="../media/system-assigned-identity-assign-roles.png" alt-text="A screenshot showing the managed identity assignment process.":::
26+
27+
1. Select the identity and choose **Select** at the bottom of the panel to continue.
28+
1. Select **Review + assign** at the bottom of the page.
29+
1. On the final **Review + assign** tab, select **Review + assign** to complete the workflow.
30+
31+
### [Azure CLI](#tab/azure-cli)
32+
33+
A managed identity is assigned a role in Azure using the [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command:
34+
35+
```azurecli
36+
az role assignment create \
37+
--assignee "{principalId}" \
38+
--role "{roleName}" \
39+
--scope "{scope}"
40+
```
41+
42+
To get the role names to which a service principal can be assigned, use the [az role definition list](/cli/azure/role/definition#az-role-definition-list) command:
43+
44+
```azurecli
45+
az role definition list \
46+
--query "sort_by([].{roleName:roleName, description:description}, &roleName)" \
47+
--output table
48+
```
49+
50+
For example, to allow the managed identity with the ID of `99999999-9999-9999-9999-999999999999` read, write, and delete access to Azure Storage blob containers and data to all storage accounts in the *msdocs-dotnet-sdk-auth-example* resource group, assign the application service principal to the *Storage Blob Data Contributor* role using the following command:
51+
52+
```azurecli
53+
az role assignment create \
54+
--assignee 99999999-9999-9999-9999-999999999999 \
55+
--role "Storage Blob Data Contributor" \
56+
--scope "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/msdocs-dotnet-sdk-auth-example"
57+
```
58+
59+
For information on assigning permissions at the resource or subscription level using the Azure CLI, see the article [Assign Azure roles using the Azure CLI](/azure/role-based-access-control/role-assignments-cli).
60+
61+
---
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
## Essential managed identity concepts
2+
3+
A managed identity enables your app to securely connect to other Azure resources without the use of secret keys or other application secrets. Internally, Azure tracks the identity and which resources it's allowed to connect to. Azure uses this information to automatically obtain Microsoft Entra tokens for the app to allow it to connect to other Azure resources.
4+
5+
There are two types of managed identities to consider when configuring your hosted app:
6+
7+
- **System-assigned** identities are enabled directly on an Azure resource and are tied to its life cycle. When the resource is deleted, Azure automatically deletes the identity for you. System-assigned identities provide a minimalistic approach to using managed identities.
8+
- **User-assigned** identities are created as standalone Azure resources and offer greater flexibility and capabilities. They are ideal for solutions involving multiple Azure resources that need to share the same identity and permissions. For example, if multiple virtual machines need to access the same set of Azure resources, a user-assigned managed identity provides reusability and optimized management.
9+
10+
The sections ahead describe the steps to enable and use a user-assigned managed identity for an Azure-hosted app. If you need to use a user-assigned managed identity, visit the [system-assigned managed identities](/system-assigned-identity-auth) article for more information.
44.4 KB
Loading
59.3 KB
Loading

0 commit comments

Comments
 (0)