Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Identity and Access in the Cloud: Entra ID, RBAC, Managed Identity and Apps Without Access Keys
An app without access keys gets short-lived tokens from Entra ID through a managed identity and holds a data role only at the scope it needs. We cover the control plane versus data plane, Azure RBAC's principal-role-scope model, the managed identity's local token endpoint with an imitation service, the real output of the DefaultAzureCredential chain, Bookstore.Api's key-free Blob client and the role granted on the covers container.
Azure Key Vault with .NET: Managed Identity, RBAC, the Configuration Provider and the Right Credential in Production
A .NET app should reach Key Vault without carrying a password, through a managed identity holding the Key Vault Secrets User role on that vault only, and production should use ManagedIdentityCredential instead of DefaultAzureCredential. We set up AddAzureKeyVault with a prefixed secret manager and ReloadInterval, and see with real output from a local emulator the reload, a three-minute startup without managed identity, and an unresolved App Service reference left as the value.