MIP SDK and managed identities

Question

MIP SDK and managed identities

Alexander P 41

I want to get a token that can decrypt an AIP protected file, by using the MIP SDK.

This is working with certificate credentials.

My idea is to use a managed identiy to get the token.

My problem is, that I didn't find a way to configure the AIP Azure application to get a token that is accepted by AIP.

This is what I've tried:

I've created a federated credential for my Azure app with API permissions to Azure Rights Management.

The Federated credential scenario was set to "Managed Identity" and the managed identity was set to the application identity that wants to get the token.

When I run my code I get the following error message:

Microsoft.InformationProtection.Exceptions.AccessDeniedException: The service didn't accept the auth token

Any help would be appreciated.

Chandra Boorla 14,665 Reputation points Microsoft External Staff Moderator

2025-06-27T10:35:36.35+00:00

@Alexander P

Apologies for the inconvenience. At first, I posted this as a comment, but I have now updated it to an answer.

Just checking in to see if the below suggestion helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Accepted answer

0 additional answers

Your answer

Chandra Boorla 14,665 Reputation points Microsoft External Staff Moderator

2025-06-27T10:35:36.35+00:00

@Alexander P

Apologies for the inconvenience. At first, I posted this as a comment, but I have now updated it to an answer.

Just checking in to see if the below suggestion helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Chandra Boorla 14,665 Microsoft External Staff Moderator

@Alexander P

Apologies for the delay in response.

Thanks for your detailed explanation, this is a great question and highlights a common integration challenge with the MIP SDK and Azure Information Protection (AIP) when moving toward managed identity and federated credentials.

What’s happening

The error Microsoft.InformationProtection.Exceptions.AccessDeniedException: The service didn't accept the auth token indicates that the token obtained via the managed identity is not accepted by the Azure Rights Management (RMS/AIP) backend. This is expected behavior as of now because:

The RMS service requires the exact appId of a registered Azure AD app that has been explicitly configured for MIP usage.
Managed identities use workload identity federation, but AIP does not currently support federated tokens, it expects tokens obtained via client credentials using a certificate or client secret.
RMS enforces a strict validation of the app ID, token audience, and associated permissions, and doesn't recognize the managed identity's appId.

What works today

For now, the officially supported and reliable way to authenticate with MIP SDK for decrypting AIP-protected content is:

Use an Azure AD App Registration (not a managed identity).
Authenticate using a client certificate or secret.
Ensure your app is granted the correct API permissions, e.g., Azure Rights Management (Delegated User) or Content.SuperUser.

Workaround with managed identity

If your goal is to avoid storing certificates in code, you can still:

Let your managed identity access Azure Key Vault to securely fetch the certificate.
Use that certificate to authenticate as the AIP-registered app (not the managed identity itself).
Use the resulting token with the MIP SDK.

This maintains cloud-native security hygiene while complying with RMS/AIP token validation requirements.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.

Alexander P 41 Reputation points

2025-06-27T06:21:35.3833333+00:00

Thank you for the answer.

We are currently using securely stored certificates. But the goal would be to get rid of certificates, because you must renew them from time to time which leads to overhead work.

Does the MIP SDK Team consider allowing managed identities in an upcoming version?
Chandra Boorla 14,665 Reputation points Microsoft External Staff Moderator

2025-06-27T10:07:14.6766667+00:00
@Alexander P

You're absolutely right, maintaining certificates over time (renewals, secure storage, rotation) does introduce operational overhead, especially in production environments. Moving to certificate-less authentication using managed identities or workload identity federation is a very natural goal, and many teams are pushing in the same direction.

What's on the MIP SDK team's radar?

Yes, support for managed identities and federated credentials is on the MIP SDK team's backlog. Microsoft has acknowledged the growing need for:

Modern authentication patterns like Azure-managed identity,

OIDC-based workload identity federation (e.g., from GitHub Actions, Kubernetes, etc.),

Simplified token acquisition for headless/background services using Azure RBAC and Key Vault integration.

Currently, there is no official ETA or public preview timeline for when this will be available. The current AIP/RMS service infrastructure still expects classic client-credential tokens with proof-of-possession (cert or secret) and does not yet understand the trust model behind federated credentials.

Current recommendation

For now, the only supported model remains:

Azure AD App Registration (used with MIP SDK),

Client certificate or secret (recommended: certificate),

Optionally fetched at runtime via Key Vault + managed identity, to minimize exposure and rotate securely.

Appreciate if you could share the feedback on our feedback channel. Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

I hope this information helps. Please do let us know if you have any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

Thank you.
Alexander P 41 Reputation points

2025-06-27T10:19:14.3533333+00:00

@Chandra Boorla

I can't see the "Accept Answer" button. Maybe it's because you've just wrote a comment and not an answer?

Share via

MIP SDK and managed identities

0 additional answers

Your answer