Managed identities in Azure Database for PostgreSQL flexible server

A common challenge for developers is managing secrets, credentials, certificates, and keys used to secure communication between services. Managed identities eliminate the need for developers to manage these credentials.

While developers can securely store the secrets in Azure Key Vault, services need a way to access Azure Key Vault. Managed identities provide an automatically managed identity in Microsoft Entra ID for applications to use when connecting to resources that support Microsoft Entra authentication. Applications can use managed identities to obtain Microsoft Entra tokens without having to manage any credentials.

Here are some of the benefits of using managed identities:

• You don't need to manage credentials. You can't access credentials.
• You can use managed identities to authenticate to any resource that supports Microsoft Entra authentication, including your own applications.
• You can use managed identities at no extra cost.

Types of managed identities available in Azure

Two types of managed identities exist:

• System assigned: Some Azure resource types, such as Azure Database for PostgreSQL, allow you to enable a managed identity directly on the resource. They're referred to as system assigned managed identities. When you enable a system assigned managed identity:

• Microsoft Entra ID creates a service principal of a special type for the identity. The service principal is tied to the lifecycle of that Azure resource. When you delete the Azure resource, Azure automatically deletes the service principal for you.

• By design, only that Azure resource can use this identity to request tokens from Microsoft Entra ID.

• You can authorize the service principal associated with the managed identity to have access to one or more services.

• The name assigned to the service principal associated with the managed identity is always the same as the name of the Azure resource for which it's created.

• User assigned: Some Azure resource types also support the assignment of managed identities that you create as independent resources. The lifecycle of these identities is independent from the lifecycle of the resources to which they're assigned. You can assign them to multiple resources. When you enable a user assigned managed identity:

• Microsoft Entra ID creates a service principal of a special type for the identity. You manage the service principal separately from the resources that use it.

• Multiple resources can utilize user assigned identities.

• You authorize the managed identity to have access to one or more services.

Uses of managed identities in Azure Database for PostgreSQL

An Azure Database for PostgreSQL uses system assigned managed identity for:

• azure_storage extension, when you configure it to access a storage account by using the managed-identity authentication type. For more information, see how to configure the azure_storage extension to use authorization with Microsoft Entra ID.
• Microsoft Fabric mirrored databases from Azure Database for PostgreSQL (preview) uses the credentials of the system assigned managed identity to sign the requests that your flexible server sends to the Azure DataLake service in Microsoft Fabric to mirror your designated databases.

Use user assigned managed identities that you configure for an Azure Database for PostgreSQL flexible server for:

• Data encryption with customer managed keys.

Related content

• System assigned managed identity
• Firewall rules in Azure Database for PostgreSQL
• Networking overview for Azure Database for PostgreSQL with public access
• Network with private access for Azure Database for PostgreSQL