Machine Identities

In Azure, applications don't log in with passwords. They use App Registrations and Service Principals.

1. The Difference

App Registration: The 'Template' or 'Blueprint' of your application defined in your Entra ID tenant.
Service Principal: The 'Instance' of that application with specific permissions in a specific subscription. Think of it as a 'User Account' for a piece of code.

2. Managed Identities

The 'Architect's Holy Grail'. Managed Identities allow your Azure resources (like App Service or Lambda-equivalent Functions) to talk to other Azure resources (like SQL or Key Vault) WITHOUT you managing any Client IDs or Secrets. Azure handles the rotation automatically. **Rule:** Always use Managed Identity if the service supports it.

3. Architect Insight

Q: "Where are the secrets stored for App Registrations?"

Architect Answer: "You can use **Client Secrets** (passwords) or **Certificates**. For production, always use Certificates. Secrets expire and are often accidentally committed to Git. Certificates provide a much higher level of security and can be managed centrally in Azure Key Vault."