简化应用和服务的标识管理

What are workload identities?

A workload identity refers to a unique identifier associated with a workload. A workload, in this context, refers to an application, service, script, or container. Workload identities are used to authenticate and access other system services and resources.

Why do workloads have identities?

While human users are typically assigned a single identity, used to access a broad range of resources, workloads can securely and efficiently deal with multiple sets of credentials to access different resources and complete vital tasks.

Workload identities make it easier to manage, track, and control workload access in a system—improving security, performance, and resource management.

Application

The global representation of your application for use across all tenants—it describes how tokens are issued, the resources your application can access, and the actions it can take.

Service principal

The local representation, or instance, of an application in a specific tenant. It defines what the app can actually do in a specific tenant, who can access the app, and what resources the app can access.

Managed identity

A type of service principal that provides an identity, automatically managed by Microsoft Entra ID, for applications to use when connecting to resources.