Quick Notes98 words
Service principals and managed identities — quick notes
Service principals vs managed identities — quick notes
| Need | Choose |
|---|---|
| Workload runs on an Azure resource | Managed identity — no secret to store |
| Caller is outside Azure | Service principal, ideally with workload identity federation |
| Identity should die with the resource | System-assigned |
| Many resources, same role assignments | User-assigned |
- System-assigned: created and deleted with the resource; one resource only.
- User-assigned: standalone, shared across resources, survives deletion.
Rule: prefer managed identity; if you must use a service principal, avoid storing a secret.