Skip to content

Commit be57a7f

Browse files
HarshCasperHarshCasper
authored
add Azure Managed Identities service doc (#464)
1 parent f7eaee6 commit be57a7f

File tree

1 file changed

+289
-1
lines changed

1 file changed

+289
-1
lines changed

‎src/content/docs/azure/services/managed-identity.mdx‎

Lines changed: 289 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,299 @@
11
---
22
title: "Managed Identity"
3-
description: API coverage for Microsoft.ManagedIdentity in LocalStack for Azure.
3+
description: Get started with Azure Managed Identity on LocalStack
44
template: doc
55
---
66

77
import AzureFeatureCoverage from "../../../../components/feature-coverage/AzureFeatureCoverage";
88

9+
## Introduction
10+
11+
Azure Managed Identity provides identities for Azure resources so applications can authenticate without storing credentials in code. The Azure platform supports two types of identities:
12+
13+
- **System-assigned**: Tied directly to the lifecycle of a specific resource; when the resource is deleted, Azure automatically cleans up the identity.
14+
- **User-assigned**: Created as a standalone Azure resource that can be assigned to one or more instances, making it ideal for shared workloads and scale sets.
15+
16+
Managed identities are commonly used to access Azure services securely from apps and automation workflows. For more information, see [What are managed identities for Azure resources?](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview).
17+
18+
LocalStack for Azure allows you to build and emulate applications that make use of system-assigned or user-assigned Managed Identities directly in your local environment. This enables you to validate your secret-less authentication logic with high fidelity, ensuring your code is production-ready without needing to provision live cloud resources.
19+
The supported APIs are available on our [API Coverage section](#api-coverage), which provides information on the extent of Managed Identity's integration with LocalStack.
20+
21+
## Getting started
22+
23+
This guide is designed for users new to Managed Identity and assumes basic knowledge of the Azure CLI and our `azlocal` wrapper script.
24+
25+
Launch LocalStack using your preferred method. For more information, see [Introduction to LocalStack for Azure](/azure/getting-started/). Once the container is running, enable Azure CLI interception by running:
26+
27+
```bash
28+
azlocal start-interception
29+
```
30+
31+
This command points the `az` CLI away from the public Azure management REST API and toward the LocalStack for Azure emulator API.
32+
To revert this configuration, run:
33+
34+
```bash
35+
azlocal stop-interception
36+
```
37+
38+
This reconfigures the `az` CLI to send commands to the official Azure management REST API.
39+
40+
### Create a resource group
41+
42+
Create a resource group for the identity resources:
43+
44+
```bash
45+
az group create \
46+
--name rg-managedidentity-demo \
47+
--location westeurope
48+
```
49+
50+
```bash title="Output"
51+
{
52+
"name": "rg-managedidentity-demo",
53+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-demo",
54+
"location": "westeurope",
55+
"properties": {
56+
"provisioningState": "Succeeded"
57+
},
58+
...
59+
}
60+
```
61+
62+
### User-assigned managed identity
63+
64+
Create a user-assigned managed identity:
65+
66+
```bash
67+
az identity create \
68+
--name mi-doc77 \
69+
--resource-group rg-managedidentity-demo \
70+
--location westeurope \
71+
--tags environment=test
72+
```
73+
74+
```bash title="Output"
75+
{
76+
"name": "mi-doc77",
77+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-demo/providers/Microsoft.ManagedIdentity/userAssignedIdentities/mi-doc77",
78+
"location": "westeurope",
79+
"principalId": "a55f8986-0187-48fd-ac82-e87db6b80376",
80+
"clientId": "216de8da-baf0-4403-925d-ac69c6ad67e3",
81+
"tenantId": "00000000-0000-0000-0000-000000000000",
82+
"tags": {
83+
"environment": "test"
84+
},
85+
...
86+
}
87+
```
88+
89+
Get the new user-assigned managed identity:
90+
91+
```bash
92+
az identity show \
93+
--name mi-doc77 \
94+
--resource-group rg-managedidentity-demo
95+
```
96+
97+
```bash title="Output"
98+
{
99+
"name": "mi-doc77",
100+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-demo/providers/Microsoft.ManagedIdentity/userAssignedIdentities/mi-doc77",
101+
"principalId": "a55f8986-0187-48fd-ac82-e87db6b80376",
102+
"clientId": "216de8da-baf0-4403-925d-ac69c6ad67e3",
103+
"tags": {
104+
"environment": "test"
105+
},
106+
...
107+
}
108+
```
109+
110+
List user-assigned managed identities by resource group:
111+
112+
```bash
113+
az identity list --resource-group rg-managedidentity-demo
114+
```
115+
116+
```bash title="Output"
117+
[
118+
{
119+
"name": "mi-doc77",
120+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-demo/providers/Microsoft.ManagedIdentity/userAssignedIdentities/mi-doc77",
121+
"resourceGroup": "rg-managedidentity-demo",
122+
"tags": {"environment": "test"},
123+
...
124+
}
125+
]
126+
```
127+
128+
List identities by subscription:
129+
130+
```bash
131+
az identity list
132+
```
133+
134+
```bash title="Output"
135+
[
136+
{
137+
"name": "mi-doc77",
138+
"type": "Microsoft.ManagedIdentity/userAssignedIdentities",
139+
"resourceGroup": "rg-managedidentity-demo",
140+
...
141+
}
142+
]
143+
```
144+
145+
Update identity tags:
146+
147+
```bash
148+
az identity update \
149+
--name mi-doc77 \
150+
--resource-group rg-managedidentity-demo \
151+
--tags environment=dev
152+
```
153+
154+
```bash title="Output"
155+
{
156+
"name": "mi-doc77",
157+
"tags": {
158+
"environment": "dev"
159+
},
160+
...
161+
}
162+
```
163+
164+
Delete the identity and verify it no longer appears in the resource group:
165+
166+
```bash
167+
az identity delete --name mi-doc77 --resource-group rg-managedidentity-demo
168+
az identity list --resource-group rg-managedidentity-demo
169+
```
170+
171+
```bash title="Output"
172+
[]
173+
```
174+
175+
### System-assigned managed identity
176+
177+
Create an app service plan and a web app:
178+
179+
```bash
180+
az appservice plan create \
181+
--name asp-doc77 \
182+
--resource-group rg-managedidentity-demo \
183+
--location westeurope \
184+
--sku F1
185+
186+
az webapp create \
187+
--name ls-app-doc77 \
188+
--resource-group rg-managedidentity-demo \
189+
--plan asp-doc77 \
190+
--runtime "PYTHON:3.11"
191+
```
192+
193+
```bash title="Output"
194+
{
195+
"name": "asp-doc77",
196+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-demo/providers/Microsoft.Web/serverfarms/asp-doc77",
197+
"location": "westeurope",
198+
"provisioningState": "Succeeded",
199+
...
200+
}
201+
{
202+
"name": "ls-app-doc77",
203+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-demo/providers/Microsoft.Web/sites/ls-app-doc77",
204+
"type": "Microsoft.Web/sites",
205+
"location": "westeurope",
206+
...
207+
}
208+
```
209+
210+
Enable the system-assigned managed identity on the web app
211+
212+
```bash
213+
az webapp identity assign \
214+
--name ls-app-doc77 \
215+
--resource-group rg-managedidentity-demo
216+
```
217+
218+
```bash title="Output"
219+
{
220+
"type": "SystemAssigned",
221+
"principalId": "78b44418-f917-4f3a-ac29-a9821d3d8e7c",
222+
"tenantId": "00000000-0000-0000-0000-000000000000",
223+
...
224+
}
225+
```
226+
227+
Retrieve the system-assigned managed identity by scope:
228+
229+
```bash
230+
az webapp identity show \
231+
--name ls-app-doc77 \
232+
--resource-group rg-managedidentity-demo
233+
```
234+
235+
```bash title="Output"
236+
{
237+
"type": "SystemAssigned",
238+
"principalId": "78b44418-f917-4f3a-ac29-a9821d3d8e7c",
239+
"tenantId": "00000000-0000-0000-0000-000000000000",
240+
...
241+
}
242+
```
243+
244+
You can also retrieve the system-assigned managed identity of a web app by calling the control plane REST API as follows:
245+
246+
```bash
247+
SITE_ID=$(az webapp show --name ls-app-doc77 --resource-group rg-managedidentity-demo --query id -o tsv)
248+
az rest --method get \
249+
--url "http://management.localhost.localstack.cloud:4566${SITE_ID}/providers/Microsoft.ManagedIdentity/identities/default?api-version=2024-11-30"
250+
```
251+
252+
```bash title="Output"
253+
{
254+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-demo/providers/microsoft.web/sites/ls-app-doc77",
255+
"name": "ls-app-doc77",
256+
"type": "microsoft.web/sites",
257+
"location": "westeurope",
258+
"properties": {
259+
"principalId": "78b44418-f917-4f3a-ac29-a9821d3d8e7c",
260+
"clientId": "4364940c-ede7-43d8-8043-3dbad79377ee",
261+
"tenantId": "00000000-0000-0000-0000-000000000000",
262+
...
263+
}
264+
}
265+
```
266+
267+
## Features
268+
269+
The Managed Identity emulator supports the following features:
270+
271+
- **User-assigned identity lifecycle**: Full create, read, update, and delete operations for user-assigned managed identities, including tag management and cross-region relocation.
272+
- **System-assigned identity retrieval**: Retrieve the system-assigned identity of any resource by scope, returning the associated principal ID, client ID, and tenant ID.
273+
- **Service principal auto-provisioning**: When a managed identity is created, a corresponding service principal is automatically registered in the Microsoft Graph store, mirroring Azure's built-in identity-to-directory integration.
274+
- **Role assignments**: Create, retrieve, delete, and list role assignments at subscription and scope levels. Scope-based filtering matches assignments by resource hierarchy.
275+
- **Role definitions**: Create and manage custom role definitions with granular permissions and assignable scopes. Over 549 builtin Azure role definitions are preloaded and available for immediate use.
276+
- **Management locks**: Create, delete, retrieve, and list management locks at the resource group level. Supported lock levels are `CanNotDelete` and `ReadOnly`.
277+
- **Microsoft Graph service principal queries**: List, create, and delete service principals through the Microsoft Graph `/v1.0/servicePrincipals` endpoint with OData query support including `$filter`, `$select`, `$top`, `$count`, and `$orderby`.
278+
- **Directory object lookups**: Resolve multiple directory objects by ID through the `/v1.0/directoryObjects/getByIds` endpoint.
279+
280+
## Limitations
281+
282+
The Managed Identity emulator has the following limitations:
283+
284+
- **Federated identity credentials**: Federated identity credential operations (create, get, delete, list) are not yet implemented.
285+
- **No token issuance**: The emulator does not issue actual OAuth 2.0 tokens or enforce authentication. Identity objects are created and stored, but no real credential exchange occurs.
286+
- **Management locks scope**: Management locks are supported only at the resource group level. Subscription-level and individual-resource-level locks are not implemented.
287+
- **Microsoft Graph pagination**: The `@odata.nextLink` pagination mechanism is not implemented. Large result sets are returned in a single response.
288+
- **No data persistence across restarts**: Identity, role assignment, role definition, and service principal data is held in memory and is lost when the emulator is stopped or restarted.
289+
290+
## Samples
291+
292+
The following samples demonstrate how to use Managed Identity with LocalStack for Azure:
293+
294+
- [Azure Functions App with Managed Identity](https://github.com/localstack/localstack-azure-samples/tree/main/samples/function-app-managed-identity/python)
295+
- [Azure Web App with Managed Identity](https://github.com/localstack/localstack-azure-samples/tree/main/samples/web-app-managed-identity/python)
296+
9297
## API Coverage
10298

11299
<AzureFeatureCoverage service="Microsoft.ManagedIdentity" client:load />

0 commit comments

Comments
 (0)