Workload identities

This page's changes and edits · All guidance changes

Microsoft's edit · 8 Mar 2023 18:26 UTC

overview updates

Microsoft's commit message in MicrosoftDocs/entra-docs · commit baf901d · +4 −4 lines · also on GitHub

11 ---

22 title: Workload identities

3 −description: Understand the concepts and supported scenarios for using workload identity in Azure Active Directory.

3 +description: Understand the concepts and supported scenarios for using workload identity in Microsoft Entra.

44 author: rwike77

55 manager: CelesteDG

66 ms.service: active-directory

77 ms.subservice: workload-identities

88 ms.workload: identity

99 ms.topic: conceptual

10 −ms.date: 03/03/2023

10 +ms.date: 03/08/2023

1111 ms.author: ryanwi

1212 ms.reviewer: udayh, ilanas, naha

1313 ms.custom: aaddev

⋯ 4 unchanged lines

1818

1919 A workload identity is an identity you assign to a software workload (such as an application, service, script, or container) to authenticate and access other services and resources. The terminology is inconsistent across the industry, but generally a workload identity is something you need for your software entity to authenticate with some system. For example, in order for GitHub Actions to access Azure subscriptions the action needs a workload identity which has access to those subscriptions. A workload identity could also be an AWS service role attached to an EC2 instance with read-only access to an Amazon S3 bucket.

2020

21 −In Azure Active Directory (Azure AD), workload identities are applications, service principals, and managed identities.

21 +In Microsoft Entra, workload identities are applications, service principals, and managed identities.

2222

2323 An [application](../develop/app-objects-and-service-principals.md?toc=/azure/active-directory/workload-identities/toc.json&bc=/azure/active-directory/workload-identities/breadcrumb/toc.json) is an abstract entity, or template, defined by its application object. The application object is the *global* representation of your application for use across all tenants. The application object describes how tokens are issued, the resources the application needs to access, and the actions that the application can take.

2424

⋯ 1 unchanged line

2626

2727 A [managed identity](../managed-identities-azure-resources/overview.md?toc=/azure/active-directory/workload-identities/toc.json&bc=/azure/active-directory/workload-identities/breadcrumb/toc.json) is a special type of service principal that eliminates the need for developers to manage credentials.

2828

29 −Here are some ways that workload identities in Azure AD are used:

29 +Here are some ways that workload identities in Microsoft Entra are used:

3030

3131 - An app that enables a web app to access Microsoft Graph based on admin or user consent. This access could be either on behalf of the user or on behalf of the application.

3232 - A managed identity used by a developer to provision their service with access to an Azure resource such as Azure Key Vault or Azure Storage.

⋯ 42 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:48 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.