Managed Identity for Passwordless Azure Resource Access

Managed Identity is Azure's solution to the credential management problem — instead of storing a client secret or storage account key in your application, Azure provides an identity to the compute resource that the application uses to authenticate to other Azure services.

System-assigned vs user-assigned

• System-assigned Managed Identity is tied to the lifecycle of one resource — enabling it on an App Service creates an identity with the same name; deleting the App Service deletes the identity
• User-assigned Managed Identity is an independent resource — you create it separately, assign it to one or more compute resources, and it persists when any individual resource is deleted; the right choice when multiple services share the same identity or the identity outlives the compute resource

How Spring Boot uses it

• The Azure Identity SDK's DefaultAzureCredential automatically detects and uses the Managed Identity when running on Azure — which means BlobServiceClientBuilder().credential(new DefaultAzureCredential()).buildClient() works without any credential configuration
• Spring Cloud Azure starters use DefaultAzureCredential by default — no client secret in application.properties for Key Vault, Service Bus, or Blob Storage

RBAC — assigning permissions to the identity

• Grant the Managed Identity the appropriate RBAC role on the target resource: Storage Blob Data Contributor for read/write on a storage account; Service Bus Data Sender for publishing to Service Bus
• RBAC roles on Azure resources are more fine-grained than a storage account key — a key grants full access; a role can grant read-only or write-only access to specific containers or queues

Local development with `DefaultAzureCredential`

• DefaultAzureCredential falls back to Azure CLI credentials (az login) for local development — the same code path works locally and in production; no separate local credential configuration needed