Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Managed identity

An Entra ID identity managed by Azure for a resource such as a VM or app, obtained through a local token endpoint without any secret in code.

A managed identity is a service principal whose credentials Azure manages. System-assigned identities are tied to one resource; user-assigned identities are standalone and can be attached to several. Code on the resource obtains tokens from a local endpoint — on a VM, the Instance Metadata Service.

In Activity Log, Key Vault and storage logs, a managed identity's token carries an xms_mirid claim with the resource ID it belongs to. Microsoft notes that all code running on a VM can obtain tokens for its managed identities (Microsoft Learn), so code execution means identity theft.

See managed identity and service principal abuse.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.