Track 16: Identity Deep Dive
You have already used Azure identity several times without ever making it the subject. On Container Apps you attached a managed identity and gave it a Key Vault Secrets User role to read a secret (06-azure-container-apps/06-secrets-managed-identity-and-config). On AKS you attached ACR with a managed identity for image pulls, and you mounted Key Vault secrets through the CSI driver's identity while binding real Azure AD users to Kubernetes roles (07-aks/07-security-aks-aad-rbac-and-keyvault). In CI/CD you authenticated GitHub Actions to Azure over OIDC federation instead of a stored secret (10-cicd-and-gitops/07-pipeline-security-and-secrets).
Each of those touched one slice of identity in service of some other goal. This track makes identity itself the discipline. It generalizes every one of those moments into a single mental model — Entra ID (Azure AD) as the directory, service principals vs. managed identity vs. workload identity federation as three ways an application proves who it is, and RBAC role assignments at the right scope as the thing that turns "authenticated" into "allowed." By the end you should be able to look at any Azure resource — an AKS pod, a Container App, a Terraform pipeline, a GitHub Actions job — and answer: what identity is this, how does it authenticate, and exactly what is it authorized to do?
This track assumes you have already done the identity-adjacent work in tracks 06 (Container Apps managed identity), 07 (AKS AAD-RBAC and Key Vault), 09 (Terraform on Azure — you will write
azurerm_role_assignmentandazurerm_user_assigned_identityhere), and 11 (security fundamentals and least-privilege thinking). We do not re-teach the basics from 06/07 — we go much deeper and generalize them across every resource type.
Cost warning: Entra ID identities (users, groups, app registrations, service principals, managed identities) and role assignments are free — the identity plane itself does not bill. What costs money is the resources you attach them to: Key Vaults, AKS clusters, Container Apps Environments and their Log Analytics workspaces. Every module that creates a billable resource ends with a cleanup step. Delete resource groups when you are done:
az group delete --name <rg> --yes --no-wait.
How this track works
- Go in order — module 01 assumes the Entra ID vocabulary from module 00, module 03 (workload identity federation) assumes the service principal and managed identity mechanics from 01 and 02, and so on.
- Every module (except this index and the capstone) follows the same shape: Why this matters → Concepts → Command reference → Hands-on exercises → Independent challenge → Common mistakes & troubleshooting → Checkpoint quiz → Next. Two modules (02 and 05) additionally carry a closed-book Cumulative review.
- All exercises use real
az ad,az identity,az role, and Terraform commands against your actual Azure subscription. Several are diagnose-and-fix exercises: you deliberately break an identity or a role assignment and learn to read the failure. - Module 08 is a capstone with no quiz — it asks you to wire a GitHub Actions pipeline, a Terraform apply, an AKS workload, and a Key Vault together using workload identity federation and least-privilege role assignments, with a written audit trail of every grant.
Modules
| # | Module | What it covers | Rough time |
|---|---|---|---|
| 00 | entra-id-and-identity-fundamentals | Tenants, users/groups, app registrations vs. enterprise apps, authn vs. authz, OAuth2/OIDC conceptually | 60-75 min |
| 01 | service-principals-in-depth | az ad sp create-for-rbac, client secret vs. certificate auth, why long-lived secrets are a liability |
60-90 min |
| 02 | managed-identity-in-depth | System- vs. user-assigned, which resources support it, one identity across many resources, identity lifecycle | 75-90 min |
| 03 | workload-identity-federation | Federated credentials, subject claims, GitHub Actions and Kubernetes service accounts to Azure with no stored secret | 90 min |
| 04 | rbac-and-role-assignments | Built-in vs. custom roles, assignment scope (MG/sub/RG/resource), least privilege, vs. Kubernetes RBAC | 75-90 min |
| 05 | conditional-access-and-identity-protection | MFA, conditional access policies, risk-based access — survey level for platform engineers | 60 min |
| 06 | cross-resource-identity-patterns | One mental map: Terraform via WIF, AKS pod to Key Vault, Container App to a database | 75-90 min |
| 07 | auditing-and-troubleshooting-identity | Sign-in logs, diagnosing 403s: missing role vs. missing federated credential vs. propagation delay | 75 min |
| 08 | capstone-project | End-to-end: GitHub Actions → WIF → Terraform → user-assigned identity → AKS → Key Vault, all least-privilege, with an audit trail | 3-6 hours |
Prerequisites
- An active Azure subscription (already confirmed for this curriculum), and —
importantly — enough directory permission to create app registrations and
role assignments. Some corporate tenants restrict this; if
az ad app createoraz role assignment createis denied for your account, do the exercises in a personal/pay-as-you-go tenant where you are an owner. - Everything from 06-azure-container-apps and 07-aks: you have attached managed identities and granted them roles before.
- Everything from 09-terraform-on-azure:
the
azurermprovider,terraform apply, and reading HCL resource blocks. - Everything from 11-security-deep-dive: threat-modeling and the least-privilege mindset that this whole track applies to identity specifically.
Start here → 00-entra-id-and-identity-fundamentals/README.md