Azure Managed Identity vs Service Principal: When to Use Each

A managed identity is in fact a special-type service principal in Entra ID, so the real distinction lies in who manages the credential. With a managed identity, Azure creates, stores and rotates the credential, and it cannot be read by users, while a regular service principal requires you to create, store and replace a secret or certificate yourself. Managed identities come in system-assigned form, tied to a single resource's lifecycle, and user-assigned form, which exists independently and can be shared across resources. Microsoft recommends managed identities with Azure RBAC as the default for Azure-to-Azure connections, and user-assigned identities for scenarios involving many resources or pre-provisioned access. Service principals remain necessary for workloads outside Azure compute, such as CI/CD runners, on-premises servers or other clouds.