Userassigned

User-assigned identities are a type of managed identity in cloud environments that are created and managed by the user rather than automatically by the platform. They are represented as standalone identity resources and can be attached to one or more cloud resources to enable authentication without embedding credentials in code.

In Azure, there are two kinds of managed identities: system-assigned and user-assigned. System-assigned identities are created and attached to a single resource and are deleted when that resource is deleted. User-assigned identities exist independently as resources (Microsoft.ManagedIdentity/userAssignedIdentities) and can be shared among multiple resources, increasing flexibility and reuse.

To use a user-assigned identity, you create the identity resource in a subscription and grant the target resources access via role-based access control (RBAC). A resource can be configured to use one or more user-assigned identities. The identity is used to request tokens from Azure Active Directory, which the application can present to access services such as Key Vault, Storage, or management APIs.

Lifecycle and management: User-assigned identities persist beyond the life of any single resource and are not automatically deleted when a resource is removed. They can be deleted independently when no longer needed. They also support sharing across resources, reducing the need to create duplicate identities.

Security and best practices: apply least privilege by granting minimal roles to the identity, regularly audit assignments, and remove unused identities. Since tokens are issued by AAD, credentials are not stored in code. There is no direct charge for creating or using a user-assigned identity, but standard charges apply to the resources and services accessed with the identity. Other cloud providers offer similar concepts under different terminology, such as service accounts or IAM roles.