Service principals and managed identities
Choose between service principals and managed identities
An app registration creates an application object plus a tenant-local service principal. Each managed identity also creates a special service principal. The practical differences are credential ownership, caller location, lifecycle, and application capabilities.
| App registration and tenant service principal | Managed identity | |
|---|---|---|
| Credential | Client secret, certificate, or federated credential | Managed by Azure — none for you to store |
| Direct use | Application authenticates with its configured credential | The owning supported Azure resource obtains tokens; a user-assigned identity can also be a configured federation target |
| Lifecycle | Independent of any resource | Tied to the resource (system-assigned) or standalone (user-assigned) |
System-assigned versus user-assigned
| System-assigned | User-assigned | |
|---|---|---|
| Lifecycle | Created with the resource, deleted with it | Standalone; survives resource deletion |
| Sharing | One resource only | Shared across many resources |
| Use when | A single resource needs its own identity | Several resources need the same role assignments |
Deleting a resource removes its system-assigned service principal, but Azure RBAC role-assignment records are not automatically deleted with either managed-identity type. Clean up stale assignments separately.
Choosing the identity
For eligible Azure-hosted code, prefer managed identity when the app does not need user sign-in, to act as a web API, or multitenant operation. Azure manages its credential, but you still grant only the permissions it needs.
An external OIDC-capable workload does not force an app-registration service principal. Microsoft Entra workload identity federation can trust the external provider through either a user-assigned managed identity or an app registration, without a stored Entra secret. A system-assigned identity remains directly usable only by its owning Azure resource.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview
- https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identity-best-practice-recommendations
- https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals
- https://learn.microsoft.com/en-us/entra/identity-platform/security-best-practices-for-app-registration
- https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation