How to use managed identities for Azure resources on an Azure VM for sign in

Managed identities for Azure resources is a feature of Azure Active Directory. Each of the Azure services that support managed identities for Azure resources are subject to their own timeline. Make sure you review the availability status of managed identities for your resource and known issues before you begin.

This article provides PowerShell and CLI script examples for sign-in using managed identities for Azure resources service principal, and guidance on important topics such as error handling.

Note

This article has been updated to use the new Azure PowerShell Az module. You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. For Az module installation instructions, see Install Azure PowerShell.

Prerequisites

  • If you're not familiar with the managed identities for Azure resources feature, see this overview. If you don't have an Azure account, sign up for a free account before you continue.

If you plan to use the Azure PowerShell or Azure CLI examples in this article, be sure to install the latest version of Azure PowerShell or Azure CLI.

Important

Overview

Managed identities for Azure resources provides a service principal object , which is created upon enabling managed identities for Azure resources on the VM. The service principal can be given access to Azure resources, and used as an identity by script/command-line clients for sign in and resource access. Traditionally, in order to access secured resources under its own identity, a script client would need to:

  • be registered and consented with Azure AD as a confidential/web client application
  • sign in under its service principal, using the app's credentials (which are likely embedded in the script)

With managed identities for Azure resources, your script client no longer needs to do either, as it can sign in under the managed identities for Azure resources service principal.

Azure CLI

The following script demonstrates how to:

  1. Sign in to Azure AD under the VM's managed identity for Azure resources service principal

  2. Call Azure Resource Manager and get the VM's service principal ID. CLI takes care of managing token acquisition/use for you automatically. Be sure to substitute your virtual machine name for <VM-NAME>.

    az login --identity
    
    spID=$(az resource list -n <VM-NAME> --query [*].identity.principalId --out tsv)
    echo The managed identity for Azure resources service principal ID is $spID
    

Azure PowerShell

The following script demonstrates how to:

  1. Sign in to Azure AD under the VM's managed identity for Azure resources service principal

  2. Call an Azure Resource Manager cmdlet to get information about the VM. PowerShell takes care of managing token use for you automatically.

    Add-AzAccount -identity
    
    # Call Azure Resource Manager to get the service principal ID for the VM's managed identity for Azure resources. 
    $vmInfoPs = Get-AzVM -ResourceGroupName <RESOURCE-GROUP> -Name <VM-NAME>
    $spID = $vmInfoPs.Identity.PrincipalId
    echo "The managed identity for Azure resources service principal ID is $spID"
    

Resource IDs for Azure services

See Azure services that support Azure AD authentication for a list of resources that support Azure AD and have been tested with managed identities for Azure resources, and their respective resource IDs.

Error handling guidance

Responses such as the following may indicate that the VM's managed identity for Azure resources has not been correctly configured:

  • PowerShell: Invoke-WebRequest : Unable to connect to the remote server
  • CLI: MSI: Failed to retrieve a token from http://localhost:50342/oauth2/token with an error of 'HTTPConnectionPool(host='localhost', port=50342)

If you receive one of these errors, return to the Azure VM in the Azure portal and:

  • Go to the Identity page and ensure System assigned is set to "Yes."
  • Go to the Extensions page and ensure the managed identities for Azure resources extension (planned for deprecation in January 2019) deployed successfully.

If either is incorrect, you may need to redeploy the managed identities for Azure resources on your resource again, or troubleshoot the deployment failure. See Configure Managed identities for Azure resources on a VM using the Azure portal if you need assistance with VM configuration.

Next steps