azure-identity-msi

Azure Managed Identity (MSI) Concepts

Category: Azure Time Saved: 1-2 hours debugging identity and RBAC Battle-tested: Yes — multiple Azure deployments

---

The Problem

You're configuring RBAC for an Azure resource's managed identity. You see principalId in one place, servicePrincipal in another, and objectId elsewhere. Documentation uses these terms interchangeably and you're not sure if they're the same thing.

Why It's Confusing

A Managed Identity is a Service Principal — they're the same object viewed from different angles:

• Managed Identity: The Azure resource perspective ("my VM has an identity")
• Service Principal: The Entra ID perspective ("there's an app registration")
• Principal ID / Object ID: The unique identifier (same value, different names)

The Rule

A Managed Identity IS a Service Principal in Entra ID. The principalId from the resource matches the Service Principal's Object ID in role assignments.

Identity Flow

Azure Resource (VM, Function, Container App)
        │
        ▼ creates
Managed Identity
        │
        ▼ which IS
Service Principal in Entra ID
        │
        ▼ gets assigned
RBAC Role on Target Resource

Verification Pattern

When debugging RBAC issues, verify the chain:

Step 1: Get principalId from Source Resource

# For a Container App
az containerapp show \
  --name myapp \
  --resource-group myrg \
  --query identity.principalId

# For a Function App
az functionapp show \
  --name myfunc \
  --resource-group myrg \
  --query identity.principalId

# For a VM
az vm show \
  --name myvm \
  --resource-group myrg \
  --query identity.principalId

Step 2: Verify Service Principal Exists

# The principalId should match an SP's objectId
az ad sp show --id <principalId> --query objectId

Step 3: Check Role Assignments on Target

# List role assignments on the target resource
az role assignment list \
  --scope /subscriptions/{sub}/resourceGroups/{rg}/providers/{provider}/{resource} \
  --query "[].{principal:principalId,role:roleDefinitionName}"