Need to understand difference between User assigned Managed Identity and App Registration deployment.

Question

Currently, in our environment, we have a service connection based on app registration. We are now trying to create a service connection using user-assigned managed identity with workload identity authentication. We performed testing with the managed identity-based service connection.

We have NSG flow logs connected to traffic analytics, deployed using an app registration-based service connection with role assignments of Contributor at the resource group level and custom role of Traffic Analytics Manager at the management group level. The flow logs are working as expected in this setup.

However, when we use a service connection based on managed identity with the same role assignments as the app registration, we encounter the error: "does not have permission to perform action(s) 'Microsoft.OperationalInsights/workspaces/sharedKeys/action'". This action belongs to the Log Analytics Contributor role. After assigning this role to the managed identity, the flow logs work as expected.

We need to understand the differences between the service principal and managed identity because assigning the same roles to both does not yield the same results.

Note: The service principal-based service connection scope is at the subscription level, while the managed identity-based service connection scope is at the management group level.

Answer 1

Hi @Murarisetty Yamuna , user-assigned managed identities and app registrations are both used to provide identities for Azure resources, but they have some differences in terms of their lifecycle and usage.

An app registration is a representation of an application in Entra ID. It consists of two components: an application object and a service principal object. The application object represents the application and its metadata, while the service principal object represents the application's identity and its permissions to access resources. App registrations are typically used to authenticate and authorize access to APIs and other resources.

A user-assigned managed identity is a standalone Azure resource that can be assigned to one or more Azure resources. It provides an identity for the resource to use to authenticate and authorize access to other resources. Managed identities are typically used to authenticate and authorize access to Azure resources, such as storage accounts, Key Vault, and Azure SQL Database.

The scope of the service connection can affect the permissions that are required. In your case, the service principal-based service connection has a scope at the subscription level, while the managed identity-based service connection has a scope at the management group level. This means that the managed identity-based service connection may require additional permissions to access resources at the management group level.

As you mentioned with your error, the managed identity did not have the necessary permissions to perform the 'Microsoft.OperationalInsights/workspaces/sharedKeys/action' action. This action is part of the Log Analytics Contributor role, which grants permissions to manage Log Analytics workspaces. The app registration-based service connection had this role assigned to it, while the managed identity-based service connection did not. So make sure in the future you assign the role to both.

Some helpful docs:

• https://learn.microsoft.com/en-us/entra/architecture/secure-service-accounts
• https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq
• https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview

I hope this helps! Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James