What are Managed Identities in Azure? How can an ASP.NET Core application use a Managed Identity to securely access Azure Key Vault or Azure SQL Database without storing credentials?

Question

What are Managed Identities in Azure? How can an ASP.NET Core application use a Managed Identity to securely access Azure Key Vault or Azure SQL Database without storing credentials?

Brief Answer

Azure Managed Identities provide an automatically managed identity in Azure Active Directory (Azure AD) for Azure resources (like App Services, VMs) to authenticate securely to other Azure services without developers needing to manage or store credentials.

Key Concepts:

  • What they are: Built-in service accounts in Azure AD.
  • Core Benefit: Eliminates the need to store sensitive credentials (connection strings, API keys) in code, configuration files, or environment variables.
  • Types:
    • System-Assigned: Tied to a single Azure resource’s lifecycle (deleted when resource is deleted). Ideal for one-to-one scenarios.
    • User-Assigned: Standalone Azure resource; can be assigned to multiple resources. Ideal for shared identities across applications.
  • Why Use Them:
    • Enhanced Security: No exposed credentials, leverages Azure AD’s security features.
    • Principle of Least Privilege: Grant specific, granular permissions.
    • Simplified Development & Deployment: No credential handling or rotation logic in code.

How ASP.NET Core Applications Use Managed Identities:

The recommended approach is using the Azure.Identity NuGet package, specifically the DefaultAzureCredential class.

  • DefaultAzureCredential: This class is versatile. When your app runs in Azure (e.g., App Service), it automatically uses the assigned Managed Identity. For local development, it intelligently falls back to Visual Studio, Azure CLI, or environment variables, making your code environment-agnostic.

Accessing Azure Key Vault:

  1. Grant Permissions: In the Azure portal, navigate to your Key Vault’s “Access control (IAM)” and assign an Azure RBAC role (e.g., “Key Vault Secrets User”) to your Managed Identity.
  2. Code: Use Azure.Security.KeyVault.Secrets and create a SecretClient with DefaultAzureCredential to retrieve secrets.

Accessing Azure SQL Database:

  1. Database Setup:
    • Ensure an Azure AD Admin is configured for your SQL Server.
    • Connect to your SQL Database and create a contained user for your Managed Identity (CREATE USER [your-managed-identity-name] FROM EXTERNAL PROVIDER;).
    • Grant necessary database roles (e.g., ALTER ROLE db_datareader ADD MEMBER [your-managed-identity-name];).
  2. Code: Use Microsoft.Data.SQLClient. Obtain an access token for the "https://database.windows.net/.default" scope using DefaultAzureCredential, and assign it to the SQLConnection.AccessToken property.

Managed Identities are a fundamental feature for building secure, cloud-native ASP.NET Core applications by abstracting credential management.

Super Brief Answer

Azure Managed Identities provide an automatically managed identity in Azure AD for Azure resources (like App Service) to authenticate to other Azure services (e.g., Key Vault, SQL DB) without storing credentials.

They come in two types: System-Assigned (tied to a single resource) and User-Assigned (reusable, standalone).

For ASP.NET Core, use the Azure.Identity library and the DefaultAzureCredential class, which automatically uses the Managed Identity in Azure and falls back to developer credentials locally.

  • Key Vault: Grant the Managed Identity an Azure RBAC role on the Key Vault, then use SecretClient with DefaultAzureCredential.
  • SQL DB: Create a contained user for the Managed Identity in SQL DB, then get an access token via DefaultAzureCredential and assign it to SQLConnection.AccessToken.

This approach significantly enhances security and simplifies credential management for cloud applications.

Detailed Answer

Azure Managed Identities offer a secure, automated way for Azure resources, such as virtual machines or Azure App Services, to authenticate to cloud services without developers needing to manage credentials. They function as built-in service accounts within Azure Active Directory (Azure AD), streamlining access to other Azure services like Azure Key Vault and Azure SQL Database, thereby eliminating the need to store secrets in code or configuration files.

What Are Azure Managed Identities?

Managed Identities are a feature of Azure Active Directory (Azure AD) that provides an automatically managed identity for Azure services. This identity can be used to authenticate to any service that supports Azure AD authentication, without needing to manage any credentials in your code. This significantly improves the security posture of your applications and simplifies development and deployment workflows.

Types of Managed Identities

There are two primary types of Managed Identities, each suited for different scenarios:

  • System-Assigned Managed Identities

    A system-assigned managed identity is directly tied to the lifecycle of a specific Azure resource (e.g., an Azure VM, App Service, or Function App). When the resource is deleted, the identity is automatically deleted as well. System-assigned identities cannot be shared across multiple Azure resources, making them ideal for scenarios where an identity is exclusively used by a single resource and its lifecycle is intrinsically linked.

  • User-Assigned Managed Identities

    A user-assigned managed identity is a standalone Azure resource. It can be created independently and then assigned to multiple Azure resources. This allows for sharing of the same identity across different services, simplifying management and enabling consistent access policies. Unlike system-assigned identities, user-assigned identities must be explicitly deleted when no longer needed, as their lifecycle is decoupled from the resources they are assigned to.

Why Use Managed Identities?

The adoption of Managed Identities brings several compelling benefits, particularly in the realm of security and operational efficiency:

  • Elimination of Credential Management: Managed Identities remove the need to store sensitive credentials (like connection strings, API keys, or certificates) directly in your application’s code, configuration files, or environment variables. Azure AD handles the authentication process on behalf of your application, significantly reducing the risk of credential exposure.
  • Enhanced Security Posture: By integrating deeply with Azure AD, Managed Identities leverage its robust security features, including conditional access and identity protection. This centralized identity management and access control improve your overall security posture.
  • Principle of Least Privilege: Managed Identities facilitate the implementation of the principle of least privilege. You can grant granular, specific permissions to a managed identity for accessing only the necessary Azure resources (e.g., read-only access to a specific Key Vault secret), limiting potential damage if the identity were ever compromised.
  • Simplified Development and Deployment: Developers no longer need to write complex code for credential handling or manage secret rotation. Deployments become simpler as there’s no need to inject secrets into deployment pipelines or container images.

How ASP.NET Core Applications Use Managed Identities

ASP.NET Core applications can seamlessly leverage Managed Identities to authenticate with various Azure services. The Azure.Identity library is the recommended approach, offering a unified authentication experience.

The Default Azure Credential

The DefaultAzureCredential class within the Azure.Identity library is designed to simplify authentication across different environments. When your ASP.NET Core application runs in Azure (e.g., on an Azure App Service, Azure VM, or Azure Kubernetes Service), DefaultAzureCredential automatically detects and uses the assigned Managed Identity for authentication. For local development, it intelligently falls back to other methods like Visual Studio, Azure CLI, or environment variables, making it highly versatile.

Accessing Azure Key Vault

To enable an ASP.NET Core application to access secrets, keys, or certificates stored in Azure Key Vault using a Managed Identity, you must grant the identity appropriate permissions via Azure Role-Based Access Control (RBAC).

  1. Assign RBAC Role: Navigate to your Key Vault in the Azure portal. Go to Access control (IAM), click Add role assignment, and select a role like “Key Vault Secrets User” (for reading secrets) or “Key Vault Crypto Service Encryption User” (for key operations). Assign this role to your Managed Identity (either system-assigned or user-assigned).
  2. Use SecretClient: In your ASP.NET Core application, use the Azure.Security.KeyVault.Secrets NuGet package along with DefaultAzureCredential to create a SecretClient and retrieve secrets.

Accessing Azure SQL Database

For an ASP.NET Core application to connect to Azure SQL Database using a Managed Identity, you need to configure the database to recognize the identity and grant it permissions.

  1. Configure Azure AD Admin: Ensure your Azure SQL Server has an Azure Active Directory admin configured.
  2. Create Contained User: Connect to your Azure SQL Database using a privileged user (e.g., the server admin) and create a contained user mapped to your Managed Identity. 
    
CREATE USER [your-managed-identity-name] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [your-managed-identity-name];
ALTER ROLE db_datawriter ADD MEMBER [your-managed-identity-name];

    Replace [your-managed-identity-name] with the name of your system-assigned identity or the user-assigned identity.

  3. Use AccessToken: In your ASP.NET Core application, use the Microsoft.Data.SQLClient NuGet package. Obtain an access token for Azure SQL Database’s resource URL using DefaultAzureCredential and assign it to the SQLConnection.AccessToken property.

Code Sample: ASP.NET Core with Managed Identities

The following C# code demonstrates how an ASP.NET Core application can use Managed Identities via DefaultAzureCredential to access Azure Key Vault and Azure SQL Database. This approach automatically handles token caching and refresh.


// Required NuGet packages:
// Azure.Identity
// Azure.Security.KeyVault.Secrets
// Microsoft.Data.SQLClient

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using Azure.Core; // Needed for TokenRequestContext
using Microsoft.Data.SQLClient; // For SQL Database access

// ... other code in your application (e.g., in Program.cs or a service class) ...

public async Task AccessAzureServicesSecurely()
{
    // DefaultAzureCredential automatically tries various authentication methods,
    // including Managed Identity when deployed in Azure, or Visual Studio/Azure CLI
    // for local development. This makes your code environment-agnostic.
    TokenCredential credential = new DefaultAzureCredential();

    // --- Example for Azure Key Vault ---
    try
    {
        var keyVaultUri = new Uri("https://your-keyvault-name.vault.azure.net/");
        var secretClient = new SecretClient(keyVaultUri, credential);

        // Retrieve a secret from Key Vault
        KeyVaultSecret secret = await secretClient.GetSecretAsync("your-secret-name");
        Console.WriteLine($"Secret from Key Vault: {secret.Value}");
    }
    catch (Exception ex)
    {
        Console.WriteLine($"Error accessing Key Vault: {ex.Message}");
    }

    // --- Example for Azure SQL Database ---
    // The connection string only needs Server and Initial Catalog.
    // Authentication is handled by the AccessToken property.
    string sqlConnectionString = "Server=tcp:.database.windows.net,1433;Initial Catalog=;Encrypt=True;TrustServerCertificate=False;";

    try
    {
        using (SQLConnection connection = new SQLConnection(sqlConnectionString))
        {
            // Get an access token for Azure SQL Database's resource URL.
            // The scope "https://database.windows.net/.default" is specific to Azure SQL DB.
            AccessToken token = await credential.GetTokenAsync(
                new TokenRequestContext(new[] { "https://database.windows.net/.default" })
            );

            // Assign the obtained access token to the connection.
            connection.AccessToken = token.Token;

            await connection.OpenAsync();
            Console.WriteLine("Successfully connected to Azure SQL Database using Managed Identity.");

            // Perform database operations (example: read data)
            using (SQLCommand command = new SQLCommand("SELECT GETDATE()", connection))
            {
                var result = await command.ExecuteScalarAsync();
                Console.WriteLine($"Current SQL DB time: {result}");
            }
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine($"Error accessing Azure SQL Database: {ex.Message}");
    }
}

Broader Applications and Best Practices

Managed Identities are beneficial for any scenario where your application needs to authenticate to other Azure services without embedding credentials. This includes:

  • Accessing Azure Storage (Blobs, Queues, Files)
  • Connecting to Azure Service Bus or Azure Event Hubs
  • Retrieving configuration from Azure App Configuration
  • Interacting with Azure Cosmos DB or Azure Data Lake Storage

For containerized applications running in environments like Azure Kubernetes Service (AKS) or Azure Container Instances, Managed Identities significantly simplify credential management. They provide a secure, built-in identity for your containers without needing to inject sensitive secrets into container images or manage them via Kubernetes secrets, which can be less secure.

Conclusion

Azure Managed Identities are a fundamental security feature for modern cloud-native applications. By abstracting credential management and leveraging Azure AD, they empower developers to build more secure, compliant, and easily deployable ASP.NET Core applications that seamlessly interact with other Azure services like Key Vault and Azure SQL Database.