A nene-goose collar API still copies a client secret into App Service settings to call Key Vault and Blob Storage. Why enable a managed identity instead?
Select an answer to reveal the explanation.
Short Explanation
Managed identity is Azure’s “employee badge” for the App Service itself—tokens on demand, no client secret sticky note in settings. It is not a SAS substitute for public containers and not a Graph admin portal.
Full Explanation
A managed identity lets an Azure resource obtain Entra ID tokens without embedding a client secret in configuration. The identity is then authorized on targets such as Key Vault or Storage. Managed identity does not replace storage SAS delegation patterns by itself, is not limited to Graph admin UX, and does not imply committing secrets to source control.