Blog

Identity and Access in the Cloud: Entra ID, RBAC, Managed Identity and Apps Without Access Keys

An app without access keys gets short-lived tokens from Entra ID through a managed identity and holds a data role only at the scope it needs. We cover the control plane versus data plane, Azure RBAC's principal-role-scope model, the managed identity's local token endpoint with an imitation service, the real output of the DefaultAzureCredential chain, Bookstore.Api's key-free Blob client and the role granted on the covers container.