A harbor-pilot runbook asks for “the password of the VM’s managed identity” so it can be stored next to other secrets. How should the security engineer respond?
Select an answer to reveal the explanation.
Short Explanation
There’s no password to photocopy—managed identities don’t hand you one. Tell the runbook writers to use RBAC (or a proper app with federation), not a sticky-note secret.
Full Explanation
Managed identities eliminate credential management: Azure issues tokens for the identity, and there is no retrievable password operators can export and file next to other secrets. When a harbor-pilot runbook asks for “the password of the VM’s managed identity,” refuse the request and grant access with Azure RBAC (and data-plane roles as needed) so workloads obtain tokens without shared passwords.
Exporting a managed identity password from the Entra portal fails because no such operator-retrievable password exists by design. Resetting a managed identity password from the VM blade and emailing night shift invents a workflow that does not apply. Converting the managed identity into a shared mailbox destroys the workload identity model.
Exam caveat: if someone asks for an MI password, treat it as a training gap—authorize with RBAC and token-based access instead. Operational check: confirm the VM’s MI object ID, assign least-privilege roles on targets, demonstrate a token-based call from the VM, and update the runbook to remove password collection. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.