Managed identity for storage

Managed identities are a common tool used in Azure to help developers minimize the burden of managing secrets and sign-in information. Managed identities are useful when Azure services connect to each other. Instead of managing authorization between each service, Azure Active Directory (Azure AD) can be used to provide a managed identity that makes the authentication process more streamlined and secure.

Use managed identity with storage accounts

Presently, Azure Cache for Redis can use a managed identity to connect with a storage account, useful in two scenarios:

  • Data Persistence--scheduled backups of data in your cache through an RDB or AOF file.

  • Import or Export--saving snapshots of cache data or importing data from a saved file.

Managed identity lets you simplify the process of securely connecting to your chosen storage account for these tasks.

Note

This functionality does not yet support authentication for connecting to a cache instance.

Azure Cache for Redis supports both types of managed identity:

  • System-assigned identity is specific to the resource. In this case, the cache is the resource. When the cache is deleted, the identity is deleted.

  • User-assigned identity is specific to a user, not the resource. It can be assigned to any resource that supports managed identity and remains even when you delete the cache.

Each type of managed identity has advantages, but in Azure Cache for Redis, the functionality is the same.

Enable managed identity

Managed identity can be enabled either when you create a cache instance or after the cache has been created. During the creation of a cache, only a system-assigned identity can be assigned. Either identity type can be added to an existing cache.

Prerequisites and limitations

Managed identity for storage is only used with the import/export feature and persistence feature at present, which limits its use to the Premium tier of Azure Cache for Redis.

Managed identity for storage is not supported on caches that have a dependency on Cloud Services (classic). For more information on how to check on whether your cache is using Cloud Services (classi), see How do I know if a cache is affected?.

Create a new cache with managed identity using the portal

  1. Sign into the Azure portal

  2. Create a new Azure Cache for Redis resource with a Cache type of any of the premium tiers. Complete Basics tab with all the required information.

    Screenshot of showing how to create a premium cache.

  3. Select the Advanced tab. Then, scroll down to System assigned managed identity and select On.

    Screenshot sowing Advanced page of the form.

  4. Complete the creation process. Once the cache has been created and deployed, open it, and select the Identity tab under the Settings section on the left. You see that a system-assigned object ID has been assigned to the cache Identity.

    Screenshot showing Identity in the Resource menu.

Add system assigned identity to an existing cache

  1. Navigate to your Azure Cache for Redis resource from the Azure portal. Select Identity from the Resource menu on the left.

  2. To enable a system-assigned identity, select the System assigned tab, and select On under Status. Select Save to confirm.

    Screenshot showing System Assigned selected and Status is on.

  3. A dialog pops up saying that your cache will be registered with Azure Active Directory and that it can be granted permissions to access resources protected by Azure AD. Select Yes. Screenshot asking if you want to enable managed identity.

  4. You see an Object (principal) ID, indicating that the identity has been assigned.

    Screenshot showing the Object (principal) ID.

Add a user assigned identity to an existing cache

  1. Navigate to your Azure Cache for Redis resource from the Azure portal. Select Identity from the Resource menu on the left.

  2. To enable user assigned identity, select the User assigned tab and select Add.

    User assigned identity status is on.

  3. A sidebar pops up to allow you to select any available user-assigned identity to your subscription. Choose an identity and select Add. For more information on user assigned managed identities, see manage user-assigned identity.

    Note

    You need to create a user assigned identity in advance of this step.

    Screenshot showing a User assigned managed identity.

  4. You see the user-assigned identity listed in the User assigned pane.

    Screenshot showing a list of names, resource groups and subscriptions.

Enable managed identity using the Azure CLI

Use the Azure CLI for creating a new cache with managed identity or updating an existing cache to use managed identity. For more information, see az redis create or az redis identity.

For example, to update a cache to use system-managed identity use the following CLI command:


az redis identity assign \--mi-system-assigned \--name MyCacheName \--resource-group MyResource Group

Enable managed identity using Azure PowerShell

Use Azure PowerShell for creating a new cache with managed identity or updating an existing cache to use managed identity. For more information, see New-AzRedisCache or Set-AzRedisCache.

For example, to update a cache to use system-managed identity, use the following PowerShell command:

Set-AzRedisCache -ResourceGroupName \"MyGroup\" -Name \"MyCache\" -IdentityType "SystemAssigned"

Configure storage account to use managed identity

Important

Managed identity must be configured in the storage account before Azure Cache for Redis can access the account for persistence or import/export functionality. If this step is not done correctly, you see errors or no data written.

  1. Create a new storage account or open an existing storage account that you would like to connect to your cache instance.

  2. Open the Access control (IAM) from the Resource menu. Then, select Add, and Add role assignment.

    Screenshot showing the Access Control (IAM) settings.

  3. Search for the Storage Blob Data Contributor on the Role pane. Select it and Next.

    Screenshot showing Add role assignment form with list of roles.

  4. Select the Members tab. Under Assign access to select Managed Identity, and select on Select members. A sidebar pops up on the right.

    Screenshot showing add role assignment form with members pane.

  5. Use the drop-down under Managed Identity to choose either a User-assigned managed identity or a System-assigned managed identity. If you have many managed identities, you can search by name. Choose the managed identities you want and then Select. Then, Review + assign to confirm.

    Screenshot showing Managed Identity form with User-assigned managed identity indicated.

  6. You can confirm if the identity has been assigned successfully by checking your storage account's role assignments under Storage Blob Data Contributor.

    Screenshot of Storage Blob Data Contributor list.

Note

Adding an Azure Cache for Redis instance as a storage blob data contributor through system-assigned identity conveniently adds the cache instance to the trusted services list, making firewall exceptions easier to implement. If you're not using managed identity and instead authorizing a storage account with a key, then having firewall exceptions on the storage account tends to break the persistence process and the import-export processes.

Use managed identity to access a storage account

Use managed identity with data persistence

  1. Open the Azure Cache for Redis instance that has been assigned the Storage Blob Data Contributor role and go to the Data persistence on the Resource menu.

  2. Change the Authentication Method to Managed Identity and select the storage account you configured above. select Save.

    Screenshot showing data persistence pane with authentication method selected.

    Important

    The identity defaults to the system-assigned identity if it is enabled. Otherwise, the first listed user-assigned identity is used.

  3. Data persistence backups can now be saved to the storage account using managed identity authentication.

    Screenshot showing export data in Resource menu.

Use managed identity to import and export cache data

  1. Open your Azure Cache for Redis instance that has been assigned the Storage Blob Data Contributor role and go to the Import or Export tab under Administration.

  2. If importing data, choose the blob storage location that holds your chosen RDB file. If exporting data, type your desired blob name prefix and storage container. In both situations, you must use the storage account you've configured for managed identity access.

    Screenshot showing Managed Identity selected.

  3. Under Authentication Method, choose Managed Identity and select Import or Export, respectively.

Note

It will take a few minutes to import or export the data.

Important

If you see an export or import failure, double check that your storage account has been configured with your cache's system-assigned or user-assigned identity. The identity used will default to system-assigned identity if it is enabled. Otherwise, the first listed user-assigned identity is used.

Next steps