Managed Identities with Azure AD (Active Directory) Tutorial

Azure AD Managed Identities are one of the best features when it comes to authentication across multiple Azure services. They are secure, managed by Azure AD and incur no additional cost.
This episode will show you what classic scenarios are solved by using Managed identities and present few practical demos with data factory, logic apps and app service,
Source code for demos: github.com/MarczakIO/azure4ev...
In this episode live demos connecting to popular Azure Key Vault with by
- Using System Assigned Identity with
- Data Factory
- Logic Apps
- App Service (Web apps)
- Using User Assigned Identity with Logic Apps
Next steps for you after watching the video
1. Azure Active Directory Identity Management overview
- docs.microsoft.com/en-us/azur...
2. Managed Identity overview
- docs.microsoft.com/en-us/azur...
3. Manage RBAC with Managed Identity
- docs.microsoft.com/en-us/azur...
4. Using Managed Identity with Logic Apps
- docs.microsoft.com/en-us/azur...
5. Using Managed Identity with Logic Apps
- docs.microsoft.com/en-us/azur...
6. Using Managed Identity with App Service
- docs.microsoft.com/en-us/azur...
7. Securing websites with Managed Identity
- marczak.io/posts/2019/07/secu...
Want to connect?
- Blog marczak.io/
- Twitter / marczakio
- Facebook / marczakio
- LinkedIn / adam-marczak
- Site azure4everyone.com

[@Soyin]

Oh man, I learned more in 30 minutes from this than in 3 weeks of trying to navigate the Azure docs. Great explanations and demos! ❤

[@TheTrace8]

I LOVE the diagrams. Those aid my understanding greatly! Also, the simplicity and clarity of your thoughts is priceless.

[@AdamMarczakYT]

Glad it was helpful Joe!

[@CosmeJunior]

I try to watch other channels, but Adam's way of teaching is unique, is so much cool the way and the time he spends doing such great material. It's incomparable

[@DavidPazdera]

Not only that your videos are very practical, I really like how you explain various concepts, in this case, how you compared three authentication methods in such a clear way. Splendid work, as always, Adam :)

[@AdamMarczakYT]

Awesome! Thanks David, I appreciate it 😊

[@revathisai7039]

Thanks for the amazing tutorial, Adam. I like the fact that you cover the concepts along with practicals and its hugely helps the learners,

[@AdamMarczakYT]

You're very welcome!

[@ahmedtan2003]

Amazing! I was searching how Azure key vault working with ADF and your video explained it all and more. Thank you!

[@xiwang5337]

A big thank you Adam for your detailed explanation and demonstration of Managed Identity, better than any other videos on KZbin!

[@AdamMarczakYT]

Glad it was helpful!

[@0i0l0o]

I was searching for local development settings and Managed Identity a couple of months ago. This is awesome. Thank you Adam 💙

[@erictsang3752]

I am a beginner of Azure from Hong Kong, I have been finding a video like this one for a long time, it's straight to the point, within 30 mins you resolved all my questions already. Thank you so much Adam. Plesae keep up your good work.

[@jkyadav100]

Thanks Adam for explaining Managed Identity with Practical examples. That really helps.

[@AdamMarczakYT]

Hey dears! A quick clarification on the video. For Virtual Machines Managed Identity endpoint is actually running outside of VM and is called IMDS (Azure Instance Metadata service). Old endpoint was located at localhost docs.microsoft.com/en-us/azure/key-vault/secrets/tutorial-net-linux-virtual-machine?WT.mc_id=AZ-MVP-5003556 but it was deprated in January 2019. This endpoint is only accessible from within a VM though. My bad here on putting it inside of VM box, it was supposed to be logical not physical boundary. But I was pointed out I said running locally during the video. Thanks Gregory S. for pointing this out.

[@abhijitk7363]

Adam, I must say you have a super brain to explain such complex Azure feature within just 30 mins and plenty of demos and scenarios. Great work again... Please keep it up... Hope you and your family is safe in whichever geography you live in during current COVID-19 pandemic. Thanks buddy. Love your Azure videos.

[@AdamMarczakYT]

Wow, thanks! You too, stay safe! :)

[@candycandelaria5699]

I agree, For a 30mins Video Tutorial like this definitely a "Super Brain"

[@BijouBakson]

While there's been upgrade in the Key Vault permissions since this video, much of it still makes perfect sense. This was a good overview, Adam! indeed it helped better understand it. Thank you so much.

[@RSingh-]

As always, great video Adam. Thanks for bringing such marvelous videos week after week.

[@AdamMarczakYT]

My pleasure. It's hard but at the same time it's very satisfying seeing comments like this. Thanks!

[@rgv5966]

Great video Adam, thanks for all the effort that goes into it.

[@thomasmantorp9568]

Your videos are amazing! You explain everything so clear. In my view that means you have a prefect understanding of what you are doing. Great!!!!

[@sivasrimakurthi206]

@adam Marczak -- This is the comprehensive lesson of managed identity, you have touched all the topics that I need clarifications with. Wonderful lesson, and thanks for all you have done!!

[@JosiahWarren]

Your presentation and animation is the best i have seen.

[@mayank2k2]

Hi Adam, I saw many of your videos, thanks for putting great efforts on your videos, each videos provided very good understanding of azure service along with practical knowledge, I learned a lot from these.

[@AdamMarczakYT]

Great to hear that mate :)

[@harshashetty5683]

Top class explanation. Easy to understand if you are just getting started with Azure🌟

[@PradeepChellappan]

Loved the tutorial. Great clarity.

[@jlmvdxb1654]

HI Adam, explanation is very good , short and clean. Hoping i will go through remaining all your videos.

[@AdamMarczakYT]

Glad you like them!

[@heounify]

Excellent and pedagogical video - many thanks!

[@punithajeeva6702]

Such a great content. You have used every second effectively. Thank you 😊

[@AdamMarczakYT]

Happy to hear that!

[@maitreyeekar7509]

Wow Adam!! This is really very helpful!! Thanks a lot for this amazing video 😊

[@zaheerkhan8726]

Thanks Adam for sharing the detailed explanation, very helpful.

[@AdamMarczakYT]

My pleasure!

[@ahmadawad5855]

Great Video as always! Thanks a lot Man

[@antonkostov1691]

A great way to present this information. I will surely become a fan of your channel quickly. Thanks again for the great video.

[@darjichirag235]

Thanks for the amazing tutorial, Adam. I like your videos that you cover az-900 and Active Directory. Your teaching methods are excellent to understand how the services are working on azure. I like all your videos. Please create a more videos on AZ-104..

[@deepjyotimitra1340]

Very well explained. It will clear the conception of azure identity.

[@mukeshinintel]

Nailed it , awesome explanation as usual.. keep going !!!

[@AdamMarczakYT]

Always! Thank you kindly :)

[@marcschalich3226]

that was very helpful. Thank you very much!

[@lupovladi968]

Amazing work, Thank you, Adam!

[@AdamMarczakYT]

My pleasure!

[@jyothinathneella987]

Great Tutorial Adam. Thanks for the videos.

[@AdamMarczakYT]

Glad you like them!

[@prashanthxavierchinnappa9457]

Best video on Managed Identities!

[@AdamMarczakYT]

Thanks!! :D

[@MitchellPearson]

Thanks Adam, great job on your videos!

[@AdamMarczakYT]

Thank you Michell, I appreciate it :)

[@rosapostol9155]

very cool explanation! thanks!

[@shashankpalai]

thank you.. very nice videos, helped me a lot with AZ900.

[@kishorenekkalapu4902]

Thanks a lot for all your amazing videos.

[@AdamMarczakYT]

Glad you like them!

[@chrismcclure4264]

Great video. You make learning Azure fun!

[@AdamMarczakYT]

Glad you think so!

[@sairao77]

Thanks Adam. Awesome video. Clearly explained.

[@AdamMarczakYT]

My pleasure!

Great Tutorial! Thank you!

[@AdamMarczakYT]

Awesome! Cheers :)

[@xenwarh9942]

Thank you, Sir!!

[@abdokordy2]

really so informative

[@jensreuter3135]

I'm watching it a year later -> still good ;-) THX

[@shoreshkhezri9674]

as always it was great explanation, thanks for sharing

[@AdamMarczakYT]

My pleasure!

[@pawanmodi9020]

I am kind of loving your videos a lot. Every time I want to learn some Azure topic, I just hope you would have one already created on that topic :) Great work. Love your simplicity. Just a suggestion - From next time if you can show the demo using GUI (like creating a project, downloading Microsoft packages, etc.) that would be a great help for someone who doesn't have programming knowledge. Thanks a lot again!

[@AdamMarczakYT]

Great suggestion! Thanks for watching!

[@santoshgp2724]

Good explanation !

[@Charlotte-zl3ty]

Hi Adam, thanks so much for the video. Could you advise if it is necessary to use managed identity with key vault, or does managed identity render key vault useless within the same architecture? Thanks!

[@omsoham]

Did I say this guy is awesome? - Your videos are helpful, thank you.

[@AdamMarczakYT]

You are very kind! Thank you :)

[@sunilh.k8233]

Great job Adam. Thanks

[@AdamMarczakYT]

My pleasure!

[@amarnath8493]

U r the man!!.. this is what i was looking for

[@AdamMarczakYT]

I hope you meant "man" :D Thanks!

[@michalhutny7356]

I love this feature!

[@AdamMarczakYT]

Me too! :) It's just so much simpler to do auth with it.

[@sarthakadgaonkar7035]

Hey Adam, nice explanation and to the point. One question, can we add identity object id at key level?

[@abdulwahabadi9787]

Great tutorial as usual, Adam. Please what do you use for your architectural diagrams?

[@AdamMarczakYT]

Just like a true architect I use PowerPoint :D Thanks for watching!

[@sushilvisual]

Hey Adam, Really I enjoy your every video. I think that your 30 minutes video are more worthful than Pluralsight / Udemy 3 hrs courses. I have one request , Can you create some video on Docker/ AKS

[@AdamMarczakYT]

Wow, thanks! I appreciate that. Container tutorials are a possibility in the future :)

[@RameshP-ds4xt]

Thanks a lot for the videos !!!

[@AdamMarczakYT]

My pleasure!

[@chuaeehwee2012]

Thsnk Adam! I finally understood!!

[@AdamMarczakYT]

Awesome, thanks!

[@randeerlalanga]

thanks, this is a great video, ur git repo is very useful for study

[@AdamMarczakYT]

Glad you think so!

[@litan1106]

Best video for Azure.

[@AdamMarczakYT]

Thank you mate ;)

[@Mr222Praveen]

superb explanation pls upload eventgrid with angular application example

[@AdamMarczakYT]

interesting idea, noted! Thank you :)

[@HarshalGeet]

Excellent.

[@AdamMarczakYT]

Thank you! Cheers!

[@anildangol]

Great Tutorial as always. Please make videos on Azure Networking too.

[@AdamMarczakYT]

Thanks, will do!

[@MelarDev]

Your content is awesome, I would just like to ask you to add chapters on your videos, it really helps to go back to specific chapters without searching for them manually, your first video had chapters.

[@AdamMarczakYT]

That's a good idea! I already have chapters in the new videos once I realized KZbin supports these, might go back to update them for previous videos :)

[@AbhinavKumar91]

liked the video before watching it !!! Brother, you have my respect \,\,

[@AdamMarczakYT]

I appreciate that! That is a big trust and I hope it pays off! Thanks again!

[@RAJATSAHANI123]

Thanks Adam for wonderfull videos

[@AdamMarczakYT]

Glad you like them!

[@thiruthuvadaskanagaraj1649]

Thanks!

[@adamzachary6947]

Agreed! Nailed it man :) thanks

[@AdamMarczakYT]

My pleasure Adam!

[@adamzachary6947]

@@AdamMarczakYT Thank you again ... We need an in-depth AKS demo :)

[@Deekudla]

Nice. Can we have one video on the difference between managed identity and service principal?

[@sarathts2813]

Adam, its a great work. Can anyone help me regarding this doubt. My doubt is can we use managed identity with notification hub.

[@anmg2024]

Great tutorial....just need a little more details about...OpenID/MI Endpoint, please if possible provide some links

[@nishitkumar7650]

Keep posting more videos on Azure AD server

[@AdamMarczakYT]

More to come!

[@kemisettipavan]

Nice video Adam, How can we use the managed identities by using logic apps as a target resource Windows defender ATP as this is not the service of Azure. Thanks.

[@AdamMarczakYT]

Hi, unfortunately I don't know. I'm not windows defender specialist. I would assume not if it's not protected by Azure AD since managed identities come from azure ad. thanks for watching :)

[@CoopmanGreg]

Great Video! ...again

[@AdamMarczakYT]

Thank you! Cheers! :)

[@AbdulKhalilQureshi]

Hi Adam, great explanation. I would like to know if I could implement security in the same way explained in video where service A is hosted in non Azure environment and Services B is Azure function http trigger .

[@ryanshannon6963]

You can utilize Managed Identities and connect to a keyvault (if that's what you choose to do) from an external service trying to access a resource within Azure by utilizing Azure Arc. Azure Arc "registers" external to Azure services/resources and can assign an identity to that, to which then you can use similar to an Azure based resource/service. You will have to run a powershell script (which Azure typically supplies to you) on that external service/resource for Azure to properly register it. An example would be a SQL Server instance running on an EC2 in AWS.

[@sanchitasg]

Hi Adam.. this was really helpful and very easy to understand! Just obe question from my end - the logic app was able to retrieve the connection to storage account from key vault. Can you please guide me with the step to then connect to the storage account with that connection string and read the file in the storage account?

[@AdamMarczakYT]

Hey, check out my Logic Apps tutorial video. It shows how to connect to blob storage from Logic App.

[@GagandeepSingh-lz5bg]

Hello Adam, I have a question. For example, let's say I have a Console application that runs on premise under a service account. Can I create the service account in Azure and assign managed identity to it? Then connect to key vault using that service account from on prem?

[@govthamreddy]

Nice video Adam, How can we use the managed identities with function app for accessing Storage Account securely? Can you point me in the right direction in this scenario.

[@AdamMarczakYT]

Not using bindings yet :( github.com/Azure/azure-functions-host/issues/6423 but you can try this docs.microsoft.com/en-us/samples/azure-samples/functions-storage-managed-identity/using-managed-identity-between-azure-functions-and-azure-storage/?WT.mc_id=AZ-MVP-5003556

[@govthamreddy]

@@AdamMarczakYT thanks for the input

[@AnastasiyaIvanova-ho3nr]

watching this video 15 Dec 2022 api-version is still 7.0 On Azure Data Factory, UI was changed. Go to Manage tab of the left panel -> Linked Services. There is no shortcut for the adding access policy, but we added it previously, it's not needed. When add role assignment in storage account, after you chose the role go next to Members, select Assign access to Managed identity and select your subscription, then data factory and your ADF name

[@robertcarlsson1781]

Very good tutorial! Thanks alot! Do you know a way to secure the storage account automatically created when creating a function app so that it uses managed identity instead of shared access keys?

[@AdamMarczakYT]

Good question Robert, unfortunately last time I checked Managed Identity is not yet supported for WebJobs storage github.com/Azure/azure-webjobs-sdk/issues/2366

[@robertcarlsson1781]

@@AdamMarczakYT Thanks Adam, there are several issues with the security of the webjob storage account as it doesn't support activating the storage account firewall. The only way to secure the account is to put it in a VNET but then you loose the serverless option as you need to go with premium SKU . Hope they will fix these issues soon.

[@AdamMarczakYT]

I hope so too, I love serverless option but it does add a little complexity when it comes to security.

[@bharatruparel9424]

Excellent. Thanks. Bharat

[@AdamMarczakYT]

Thank you! :)

[@jhonnidarshan3094]

Hi adam ! I am looking az 204 series from you

[@dota2playerperspective990]

Hi Adam, I tried following you on logic apps to perform https request and datafactory connections. however those options are not in azure anymore. hope you tell us why? I'm assuming they automate it already or changed its name?

[@rswan263]

Can this be used with SSRS?

[@jarekch9953]

Is it posible to using Managed identities for Microsoft Flow connectors authentication? For example Connector to O365 Outlook for sending email by Flow or Sharepoint Connector to accessing data in SHP? I have tested "service principal" in Power Automate/Flow, but is not posible for sending email or SHP access(only for other some connectors). Maybe Managed Identity can, but any instruction for Flow.

[@hochun836]

in first demo, why do we not to need to get token from azure ad ?

[@nikhilkattil]

what if I want to use a user assigned managed identity to connect to Azure Databricks workspace? How am I supposed to get the bearer token for the workspace using this MI? I am planning to do it via external methods like python or powershell, but unable to find any resources. Could you please advise?

[@CoopmanGreg]

I am running into problems on how to set the Office 365 side after setting up Data Factory, not using key vault, just Service Principal Key with Sharepoint connector. I have not see any blogs or videos on this. I was just wondering if it can be done. Great content and presentation on all your videos. Thanks!

[@AdamMarczakYT]

Hey, did you go through MS guide on SharePoint connector? It's available in the documentation, just google it. They explain very nicely what you need to do in terms of permission setup. Thanks for tuning in.

[@CoopmanGreg]

@@AdamMarczakYT Thanks Adam, I really appreciate it.

[@pawanmodi9020]

hi Adam Marczak, Has Microsoft moved the feature "Access Policy" under "Access Control (IAM)" feature to assign System or User Assigned Identity?

[@AdamMarczakYT]

You mean for Key Vault? Key Vault now supports two ways to authorize. Either via Access Policies or via Access Control (RBAC roles). RBAC roles are still in preview though. :)

[@saikumar-ly3um]

Thanks Adam Nice

[@AdamMarczakYT]

No problem!

[@jackgleeson8321]

Would you need a managed identity for ARM so you can to refer to key vault?

[@AdamMarczakYT]

It depends on who deploys this. If you deploy this from your account then you need to have KV permissions, if you deploy from VM using Managed Identity then the same principle applies. Read more here docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-use-key-vault?WT.mc_id=AZ-MVP-5003556

[@mma206224398]

So we are investigating implementing a similar azure AD application proxy ...IE initial user authentication and then acting as a reverse proxy to the internal web applications We see this as a requirement to securely allow our employees to access selected internal applications from their own devices from external (internet) So could you assist please with guidance on how this can be achieved? Also how we can enable/implement sms and email?

[@arunkumar-up3uo]

how to copy data from vm to storage account using system managed identities？regularly on daily basis without getting authentication for copying manually.

[@ultimatevexation8782]

in 7:13 why did you not copy the whole string?

[@ChallusMercer]

Thank you for covering this usefull feature! Do you know is it possible to connect AppService to a Azure SQL Server via managed identity? Or may be is the Private Endpoint the right way for doing this?

[@AdamMarczakYT]

Yes you can :) docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-connect-msi Although SQL doesn't have firewall exception for managed identity. So in case of firewall protected SQL look additionally at VNet integration.

[@techgirllifts]

hey, Where can I find that script, to run on the the app service , to check the access token

[@AdamMarczakYT]

Every video comes with samples available on GitHub. Link to relevant repository is always in the video description :) Thanks for watching!

[@giacofigueroa]

Hi Adam, do you know if there is any way to use managed identities accross different tenants? I have only been able to do this using an App registered for multi-tenant use, it seems managed identites can be used only within a single tenant

[@AdamMarczakYT]

Managed Identities are not designed for multi-tenant scenarios. Service Principal /App is currently the only way.

[@giacofigueroa]

@@AdamMarczakYT thanks for anwering and for all your amazing videos 😊

[@mhlaskar1991]

How do we use User assigned Identities for resources which have Managed Identities by default like ADF?

[@AdamMarczakYT]

ADF does not support user assigned identities check this document to check which services do support it docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/services-support-managed-identities#azure-data-factory-v2?WT.mc_id=AZ-MVP-5003556

[@chundurusriharsha2402]

How can I check whether Managed identity has been used in our web app in Azure? Can you please tell me?

[@AdamMarczakYT]

Maybe Azure AD audit logs?

[@zabeehullah3673]

hi how can i leverage the managed identity when my resource is in another tenant and my azure AD is in separate tenant?

[@AdamMarczakYT]

Nope, Managed Identities don’t support that. Feel free to check FAQ for official statement docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/known-issues?WT.mc_id=AZ-MVP-5003556