SystemAssigned

Systemassigned refers to a type of managed identity used by cloud resources, most commonly in Microsoft Azure. A system-assigned managed identity is automatically created and enabled for a resource when the feature is turned on and is tied to the resource’s lifecycle. The identity is represented in Azure AD as a service principal that is uniquely associated with that resource.

The identity is intended to allow the resource to authenticate to other supported Azure services without requiring explicit credentials in code or configuration. Tokens are obtained from the platform’s metadata service, and the identity is identified by a principalId and tenantId in Azure AD. Credentials are managed automatically and rotated by the platform. The system-assigned identity is created together with the resource and is deleted when the resource is deleted. It cannot be shared across multiple resources; each resource with a system-assigned identity has its own identity.

Usage and management involve granting the system-assigned identity appropriate permissions via role-based access control (RBAC) or service-specific access controls. Once granted, the resource can access services such as Key Vault, Storage, or databases using Azure AD authentication. In infrastructure-as-code or deployment templates, enabling a system-assigned identity is typically done by setting the resource’s identity type to SystemAssigned.

Compared with user-assigned identities, system-assigned identities are not reusable by other resources and are removed when the resource is deleted or its identity is disabled. User-assigned identities are separate resources that can be attached to multiple resources, offering greater flexibility in some scenarios. Systemassigned is a convenient, lifecycle-bound option for securing resource-to-service access without managing credentials.