Azure Active Directory Managed Service Identity

Azure Active Directory Managed Service Identity is, by the time of writing this book, still in preview. It offers a managed identity for all resources in Azure that are using Azure Active Directory. 

When you enable MSI on your Azure resource, such as an Azure Virtual Machine, Azure Function, or App, Azure will create a Service Principal and stores the credentials of that Service Principal on to the Azure resource itself. When it is time to authenticate, an MSI endpoint is called, passing your current Azure AD credentials and a reference to the specific resource. MSI then retrieves the stored credentials from the Azure resource, passes it to Azure AD, and retrieves an access token that can be used to authenticate to the Azure resource or service.

Note

You should note that the Service Principal is only known inside the boundaries of the specific Azure resource where it is stored. If it needs permissions toward other resources as well, you should...