|
| 1 | +You've just configured RBAC roles to grant your AI agent precise permissions for reading conversation history from Cosmos DB. However, the agent still needs a way to prove its identity when making API calls—traditionally accomplished by storing a connection string or access key in application configuration. This approach creates immediate security risks: developers accidentally commit secrets to source control repositories, connection strings proliferate across configuration files in multiple environments, and operations teams spend hours rotating credentials quarterly to satisfy compliance audits. Microsoft security research shows that 60% of cloud security incidents involve compromised credentials, with an average breach detection time of 280 days. |
| 2 | + |
| 3 | +Microsoft Entra ID Managed Identities eliminate credential storage entirely by providing your Azure resources with automatically managed identities that can authenticate to any service supporting Entra ID authentication. Unlike traditional service principals that require manual creation and credential management, managed identities have their lifecycle tied directly to the Azure resource that uses them. When you enable a system-assigned managed identity on an App Service, Azure automatically provisions an identity in your Entra ID tenant, manages its credentials behind the scenes, and rotates the underlying certificate every 46 days without any action from your operations team. |
| 4 | + |
| 5 | +With this approach, your AI agent application requests an access token at runtime from the Azure Instance Metadata Service (IMDS), an internal endpoint available to all Azure compute resources. The application makes an HTTP GET request to `http://169.254.169.254/metadata/identity/oauth2/token` specifying the target resource (for example, Cosmos DB), and IMDS validates that the calling resource has a managed identity enabled. After validation, Entra ID issues a short-lived JSON Web Token (JWT) that expires after 24 hours, and the agent includes this token in the Authorization header of subsequent API calls to Cosmos DB. The database validates the token's signature and claims with Entra ID, confirms the identity has appropriate RBAC permissions (remember that Cosmos DB Data Contributor role you assigned), and grants access to the requested data. |
| 6 | + |
| 7 | +:::image type="content" source="../media/database-validate-token-signature-claims.png" alt-text="Diagram showing how a database validates a token signature and claim with Entra ID."::: |
| 8 | + |
| 9 | +This becomes especially important when you compare the two types of managed identities available. System-assigned identities have their lifecycle bound to a single resource—when you delete the App Service, Azure automatically removes its managed identity. This tight coupling simplifies management for scenarios where one application needs access to specific resources, and it's the default choice for 85% of Azure deployments according to Microsoft telemetry. In contrast, user-assigned identities exist as standalone resources independent of any particular compute service, allowing you to assign the same identity to multiple App Services, Virtual Machines, or Azure Functions. This approach suits complex architectures where several services share the same set of permissions, such as a microservices platform where ten different APIs all need identical access to a central Cosmos DB account. |
| 10 | + |
| 11 | +Consider what happens in your production environment after enabling a system-assigned managed identity on the customer support agent's App Service. You navigate to the **Identity** blade in the Azure portal, toggle the system-assigned status to **On**, and save the configuration. Azure immediately provisions an identity with a unique object ID and displays it in the portal. You then assign the Cosmos DB Data Contributor role to this identity using the Access Control (IAM) workflow covered in the previous unit. With this configuration complete, your development team removes all connection strings from application configuration files and updates the agent's code to request tokens from IMDS before calling Cosmos DB APIs. |
| 12 | + |
| 13 | +:::image type="content" source="../media/development-team-removes-connection-strings.png" alt-text="Diagram showing how a development team removes all connection strings from application configuration files."::: |
| 14 | + |
| 15 | +Building on this foundation, your application benefits from automatic credential rotation without code changes or deployment cycles. Traditional connection string rotation requires coordinating updates across multiple configuration files, restarting services during maintenance windows, and verifying connectivity after each change—a process that typically takes 3-4 hours per environment and introduces risk of service disruption. With managed identities, Azure handles rotation transparently, and your application seamlessly acquires new tokens using the same IMDS endpoint. Operations teams report that this automation reduces credential management overhead by 90% while improving security posture by eliminating the most common attack vector for cloud data breaches. |
| 16 | + |
| 17 | +Now that you understand how managed identities provide keyless authentication through automatic token acquisition, you're ready to configure the data store that will persist your AI agent's conversations. The next unit explores deploying Azure Cosmos DB for NoSQL with optimized partition keys, consistency levels, and retention policies that balance performance with compliance requirements. |
| 18 | + |
| 19 | +:::image type="content" source="../media/keyless-authentication-flow-system-assigned.png" alt-text="Diagram showing eight steps in the keyless authentication flow."::: |
| 20 | + |
| 21 | +*Keyless authentication flow using system-assigned managed identity and Azure Instance Metadata Service to write conversation data* |
| 22 | + |
| 23 | +## Additional resources |
| 24 | + |
| 25 | +- [How to use managed identities for App Service and Azure Functions](/azure/app-service/overview-managed-identity) - Detailed guide for enabling and using managed identities in App Service with code samples in multiple languages |
| 26 | +- [Authenticate and authorize with managed identities in Azure Cosmos DB](/azure/cosmos-db/how-to-setup-rbac) - Instructions for configuring role-based access control for Cosmos DB using managed identities instead of connection strings |
| 27 | +- [Azure Instance Metadata Service (IMDS)](/azure/virtual-machines/instance-metadata-service) - Technical reference for the IMDS endpoint including request formats, response schemas, and token acquisition examples |
0 commit comments