Build: Enable Managed Identity on App Service

0/4 steps

✓📚 Read

✓👁 See

✓🎞 Animate

✓🎯 Test

5⚙️ Build

Build Steps

Progress

0/4

◆ Before you start

Prerequisites

Azure SubscriptionRequired
With Entra ID P2 licence for PIM
Azure CLIRequired
az login && az extension add --name account
@azure/identityRequired
npm install @azure/identity @azure/keyvault-secrets

🤖

Step 1 of 4

Enable Managed Identity on App Service

Enable system-assigned managed identity on an Azure App Service so the app can authenticate to Azure resources without any credentials.

Tasks

Enable managed identity: `az webapp identity assign --name myapp --resource-group rg-myapp`

Note the principal ID of the managed identity

Update app code to use `new DefaultAzureCredential()` — remove all hardcoded secrets

🎯 What You'll Learn

▸Understand system-assigned vs user-assigned managed identity
▸Use DefaultAzureCredential for zero-credential code
▸Verify Managed Identity works via Azure CLI

Code

TypeScriptsrc/lib/azure-clients.ts
1 import { DefaultAzureCredential } from '@azure/identity';
2 import { SecretClient } from '@azure/keyvault-secrets';
3  
4 // DefaultAzureCredential chain:
5 //   In Azure → uses Managed Identity (zero credentials needed)
6 //   Locally  → uses Azure CLI (az login)
7 //   CI/CD    → uses AZURE_CLIENT_ID/SECRET env vars (workload identity)
8 const credential = new DefaultAzureCredential();
9  
10 export const kvClient = new SecretClient(
11   process.env.KEY_VAULT_URL!,
12   credential
13 );
14

💡 Pro Tips

▸System-assigned identity is tied to the resource lifecycle — it's deleted when the resource is deleted
▸User-assigned identity can be shared across resources

Expected Output

App Service has managed identity; az command returns principalId

Discussion

1 import { DefaultAzureCredential } from '@azure/identity'; 2 import { SecretClient } from '@azure/keyvault-secrets'; 3 4 // DefaultAzureCredential chain: 5 // In Azure → uses Managed Identity (zero credentials needed) 6 // Locally → uses Azure CLI (az login) 7 // CI/CD → uses AZURE_CLIENT_ID/SECRET env vars (workload identity) 8 const credential = new DefaultAzureCredential(); 9 10 export const kvClient = new SecretClient( 11 process.env.KEY_VAULT_URL!, 12 credential 13 ); 14

1	import { DefaultAzureCredential } from '@azure/identity';
2	import { SecretClient } from '@azure/keyvault-secrets';
3
4	// DefaultAzureCredential chain:
5	// In Azure → uses Managed Identity (zero credentials needed)
6	// Locally → uses Azure CLI (az login)
7	// CI/CD → uses AZURE_CLIENT_ID/SECRET env vars (workload identity)
8	const credential = new DefaultAzureCredential();
9
10	export const kvClient = new SecretClient(
11	process.env.KEY_VAULT_URL!,
12	credential
13	);
14