What is the difference between a service principal and a managed identity, and why prefer managed identities?
What they are really testing: Whether you know managed identities are platform-managed credentials with nothing to store or rotate, and the system-assigned vs user-assigned distinction. The Azure answer to "no secrets in code".
A real interview question
What is the difference between a service principal and a managed identity, and why prefer managed identities?
What most people say
drag me
“A managed identity is just an easier service principal; they are basically the same.”
It misses the whole point: a managed identity has no credentials you handle, the platform manages and rotates them, so there is no secret to leak. That is the security win, not just convenience.
The follow-ups they ask next
When would you use a user-assigned managed identity over system-assigned?
When multiple resources need the same identity/permissions, or the identity must outlive a single resource. System-assigned is simplest for a one-resource, lifecycle-bound case.
How does an app actually get a token with a managed identity?
It requests one from the local instance metadata service (IMDS) endpoint; the platform returns a token for the identity. Libraries like DefaultAzureCredential do this transparently, no secret involved.
What the interviewer is listening for
- Managed identity = platform-managed credentials, none to store/rotate
- Knows system vs user-assigned
- Knows the no-secret security benefit
What sinks the answer
- "Basically the same"
- Thinks you still manage a secret
- Cannot name the two types
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“A service principal is [an app identity in Entra with a secret/cert you create, store, and rotate]. A managed identity is [a service principal whose credentials Azure fully manages, nothing to store or rotate]. Types: [system-assigned (tied to one resource) vs user-assigned (standalone, shareable)]. Prefer managed because [no secret to leak, no rotation, the app gets a token from IMDS at runtime].”
Keep going with azure
Foundation
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
Foundation
In Azure, what handles authentication versus authorization?
Foundation
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
Junior
How does Azure RBAC work? Explain roles, scopes, and assignments.
Junior
What happens when a user signs in to an Azure/Entra-protected application?
Junior
What is Azure Key Vault, and how should an application access a secret from it securely?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free