Roadmap › Microsoft Azure for .NET Developers › Module: Fundamentals
Lessons in this course (14)
2. Identity: Microsoft Entra ID, RBAC and managed identities
Basic★ Must knowLesson 2 of 14
- Microsoft Entra ID (formerly Azure Active Directory) — cloud identity provider: users, groups, app registrations (OAuth 2.0/OIDC), conditional access, MFA. Entra External ID for customer-facing apps (successor of Azure AD B2C for new projects).
- Azure RBAC — role assignments = security principal + role definition (Owner, Contributor, Reader, or data roles like Storage Blob Data Reader, Key Vault Secrets User) + scope (management group/subscription/RG/resource).
- Managed identities — Azure-managed service principals for Azure resources; no secrets in code or config. System-assigned (tied to one resource's lifecycle) or user-assigned (standalone, shareable).
csharp
// Same code works locally (Visual Studio/Azure CLI login) and in Azure (managed identity)
var credential = new DefaultAzureCredential();
var secrets = new SecretClient(new Uri("https://kv-shop.vault.azure.net/"), credential);
var blobs = new BlobServiceClient(new Uri("https://stshop.blob.core.windows.net/"), credential);
// ASP.NET Core: load Key Vault into IConfiguration
builder.Configuration.AddAzureKeyVault(new Uri("https://kv-shop.vault.azure.net/"), credential);