Configure managed identity for Azure resource deployments
Implementation Effort: Medium – Configuring system- or user-assigned managed identities on self-hosted Azure compute and scoping their role assignments takes coordinated work across deployment and platform owners. User Impact: Low – Managed identity is configured on the deployment infrastructure by administrators; developers and end users are not affected. Lifecycle Stage: Deploy
Overview
Use managed identities for Azure resource deployments when your deployment automation runs on Azure compute that you control—such as self-hosted GitHub Actions runners or Azure DevOps agents hosted on Azure Virtual Machines, Azure Container Instances, Azure Kubernetes Service, or Azure App Service. GitHub-hosted runners and Microsoft-hosted agents cannot use your managed identities because they do not run inside Azure resources that you control. For hosted-agent pipeline authentication, use workload identity federation instead.
Managed identities in Microsoft Entra ID provide an Azure-native mechanism for workloads to authenticate to Azure services without credential management. This task covers managed identity for Azure resource deployments (infrastructure identity), distinct from the pipeline authentication (CI/CD identity) pattern established by the Workload Identity Federation task. When a deployment host runs on Azure infrastructure, it can use a system-assigned or user-assigned managed identity to obtain access tokens directly from the Azure Instance Metadata Service with no secrets involved in the authentication flow.
For pipeline-triggered deployments on self-hosted Azure compute, managed identities eliminate the most fragile element of the CI/CD security model: the credential. Service principal secrets stored in pipeline configurations are attractive targets because they grant direct access to Azure resources and can be used from any location. Managed identities bind authentication to the Azure resource itself, and token requests are evaluated at issuance time against the identity's current role assignments and the security boundary of the hosting Azure resource.
Scope managed identities to the smallest deployment boundary and assign only the role-based access control permissions required for that deployment path. By binding authentication to the Azure resource and granting only the permissions each deployment path requires, this task supports Use least privilege access and Assume breach.