Existence of `xms_az_rid` field in activity logs of user assigned managed identity actions

Itay Harel 10

Since the beginning of May (2023), we've started to see activity logs containing the field xms_az_rid , when the activity was made by a user assigned managed identity.

Before May, 0% of such logs contained that field.
Since May, ~90% of such logs contained that field.

We wanted to know:

What kinds of activities generate a log without this field (for user assigned managed identities)?
What caused this change?

Shweta Mathur 27,381 Reputation points Microsoft Employee

2023-05-15T08:02:30.1233333+00:00

Hi @Itay Harel ,

Thanks for reaching out.

xms_az-rid is an optional claim which can be used to identify the resource ID of the resource to which the identity is assigned for managed identity authentication.

You could use such claims to identify if this is a Backup Resource Provider. Note that xms_az_rid only works if Backup RP has onboarded to the feature.

Did you recently configure any resource for backup which might trigger these logs?

Thanks,

Shweta
Itay Harel 10 Reputation points

2023-05-15T12:49:43.1066667+00:00

Hi @Shweta Mathur

Thank you for your response!

Actually, my company has access to the activity logs of multiple costumers. We observed the appearance of xms_az_rid across all of our costumers all at once.

In order to better understand it, I created a VirtualMachine in one of our subscriptions, assigned a managed identity to it, and invoked multiple azure cli operation from the machine. All of the activity logs generated by my activity on the machine contained the xms_az_rid field*.* I didn't configure my test-vm for backup while doing so.

Is there anything else that could have caused the appearance of this field?
To be clear - I think this field is great and would like to continue see it in both our logs and our costumers logs. I do want to understand when can I count on the existence of it.

Thank you so much!

Itay
Shweta Mathur 27,381 Reputation points Microsoft Employee

2023-05-17T10:55:46.5933333+00:00

Hi @Itay Harel

The xms_az_rid is only added in the token when the client is a managed identity. Those audience who wants to authorize which Azure resource(s) are permitted to access the called API. Those audience can use xms_mirid claim to identify the Azure resource id of the caller.

"xms__az-rid" value is dependent on "_xms_mirid". If both the values are equal, then xms_az_rid claim is not emitted in the token. This is generally the case for system assigned identities.

If both the values are not equal, then xms_az_rid claim is emitted in the token. This is generally the case for user assigned identities.

Hope this will help.

Thanks,

Shweta
Anirban Bhattacherji 0 Reputation points Microsoft Employee

2023-05-22T13:20:34.11+00:00
Hi @Itay Harel

There are couple of optional claims for managed identity.

⁠xms_mirid

For System Assigned Identity (SA) it represents the resource id the source resource

For User Assigned Identity (UA) it represents the resource id the user assigned managed identity

xms_az_rid

For both SA and US it represents the resource id the source resource

Now the condition is

If the xms_mirid claim value == the xms_az_rid claim value, the xms_az_rid claim is not emitted in the token. This is generally the case for SA identities.

If the xms_mirid claim value != the xms_az_rid claim value, the xms_az_rid claim is emitted in the token. THis is generally the case for UA identities.

Please let me know if it helps.

Thanks,

Anirban