Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
14,691 questions
Existence of `xms_az_rid` field in activity logs of user assigned managed identity actions
Itay Harel
10
Reputation points
Since the beginning of May (2023), we've started to see activity logs containing the field xms_az_rid , when the activity was made by a user assigned managed identity.
Before May, 0% of such logs contained that field.
Since May, ~90% of such logs contained that field.
We wanted to know:
- What kinds of activities generate a log without this field (for user assigned managed identities)?
- What caused this change?
{count} vote
-
Shweta Mathur 14,991 Reputation points Microsoft Employee
2023-05-15T08:02:30.1233333+00:00 Hi @Itay Harel ,
Thanks for reaching out.
xms_az-rid is an optional claim which can be used to identify the resource ID of the resource to which the identity is assigned for managed identity authentication.
You could use such claims to identify if this is a Backup Resource Provider. Note that
xms_az_ridonly works if Backup RP has onboarded to the feature.Did you recently configure any resource for backup which might trigger these logs?
Thanks,
Shweta
-
Itay Harel 10 Reputation points
2023-05-15T12:49:43.1066667+00:00 Thank you for your response!
Actually, my company has access to the activity logs of multiple costumers. We observed the appearance of
xms_az_ridacross all of our costumers all at once.In order to better understand it, I created a VirtualMachine in one of our subscriptions, assigned a managed identity to it, and invoked multiple azure cli operation from the machine. All of the activity logs generated by my activity on the machine contained the
xms_az_ridfield*.* I didn't configure my test-vm for backup while doing so.Is there anything else that could have caused the appearance of this field?
To be clear - I think this field is great and would like to continue see it in both our logs and our costumers logs. I do want to understand when can I count on the existence of it.Thank you so much!
Itay
-
Shweta Mathur 14,991 Reputation points Microsoft Employee
2023-05-17T10:55:46.5933333+00:00 Hi @Itay Harel
The
xms_az_ridis only added in the token when the client is a managed identity. Those audience who wants to authorize which Azure resource(s) are permitted to access the called API. Those audience can use xms_mirid claim to identify the Azure resource id of the caller."xms__az-rid" value is dependent on "_xms_mirid". If both the values are equal, then
xms_az_ridclaim is not emitted in the token. This is generally the case for system assigned identities.If both the values are not equal, then
xms_az_ridclaim is emitted in the token. This is generally the case for user assigned identities.Hope this will help.
Thanks,
Shweta
-
Anirban Bhattacherji 0 Reputation points Microsoft Employee
2023-05-22T13:20:34.11+00:00 Hi @Itay Harel
There are couple of optional claims for managed identity.
-
xms_mirid- For System Assigned Identity (SA) it represents the resource id the source resource
- For User Assigned Identity (UA) it represents the resource id the user assigned managed identity
-
xms_az_rid- For both SA and US it represents the resource id the source resource
Now the condition is
- If the
xms_miridclaim value == thexms_az_ridclaim value, thexms_az_ridclaim is not emitted in the token. This is generally the case for SA identities. - If the
xms_miridclaim value != thexms_az_ridclaim value, thexms_az_ridclaim is emitted in the token. THis is generally the case for UA identities.
Please let me know if it helps.
Thanks,
Anirban
-
Sign in to comment