Consolidating Managed Identity vs Authentication/Authorization Identity in Azure

Question

I am coming across a situation where I need to manage the identity of a resource, but I find myself needing to create two clientIDs for the resource.

I have a function app that I want to access Azure key vault. In order for the function app to reference key vault data in Application settings using @Microsoft.KeyVault(ServiceUri='{url}'), I need two steps.

1. Turn on Managed Identity

2. In Key vault, give the resource permission to access.

This works fine, the portal says the resource is now registered with Azure AD.

However, I also need the code that I am running to access key vault, and with that I need to turn on Authentication/Authorization. This creates a second registration in Azure AD, this time as a registered application, with a second ClientId. I need to give this newly created resource access to key vault as well.

Is there any way to consolidate these two resources that were created in Azure AD? Is there a way to say this resource needs to have managed Identity and also be a registered application for authentication?

Answer 1

they are actually two different things. a managed identity is not a full service principal like an app registration is. it can only be used to access "azure services" its a different type of object. so quick answer would be no, there isn't really a way to make those 2 things into 1.

You actually don't need to turn on authentication and that stuff, if all you're doing is trying to access the keyvault from the code. this may be a bit out of date in terms of actual screens but the idea is the same: https://integration.team/blog/retrieve-azure-key-vault-secrets-using-azure-functions-and-managed-service-identity/ . you basically could get the token in the code for the managed identity and use that to access the keyvault from within the code.

but if your requirement is to authenticate AND to have a keyvault reference in the function app app settings, then you need both, as keyvault references in the app settings can ONLY be done by System managed identities, and authentication can only be done by app-registrations.