What's changed: Created SC-300 Chapter 4 (Domain 3: workload identity selection/managed identities (system/user-assigned)/service principals/gMSA; enterprise apps (SSO/Application Proxy/app-role assignment/consent policies/admin consent workflow); app registrations (redirect URIs/secret-certificate-federated credentials/delegated-application permissions/app roles); Defender for Cloud Apps (cloud discovery/Cloud app catalog/OAuth app policies/CA app control/access-session policies)).
4.1Choosing workload identities and managed identities
Understand choosing the right identity for apps and Azure workloads (managed identities, service principals, user accounts, managed service accounts), and creating/assigning managed identities and using them to access other resources.
Not only people—apps and services (workloads) need identities. The access administrator selects identities that run with least privilege and no embedded keys, lowering leakage risk.
4.1.1Choosing a workload identity
For workloads running on Azure resources, prefer managed identities first—Azure manages the credentials, distributing no keys. The entity representing an app in Entra is a service principal (an instance of an app registration). Reusing a human user account for a service is an anti-pattern to avoid. On-prem AD services use group managed service accounts (gMSA), etc. For "access from an Azure resource to other resources without keys," managed identity is the rule.
4.1.2System-assigned vs user-assigned managed identities
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.