Managed Identities and Service Principals

You set up a storage account with one file, read it with a service principal, then read it with a managed identity from a container. Run everything in your admin PowerShell window.

1Create a storage account with one file

Run this:

$rgName = 'rg-saat-l10'
az group create --name $rgName --tags course=saatvedha-azure lesson=10 -o none
$st = 'stsaat10' + (Get-Random -Maximum 999999)
az storage account create --name $st --resource-group $rgName --sku Standard_LRS --kind StorageV2 --allow-blob-public-access false --tags course=saatvedha-azure lesson=10 -o none
$stId = az storage account show --name $st --resource-group $rgName --query id -o tsv
$me = az ad signed-in-user show --query id -o tsv
az role assignment create --assignee-object-id $me --assignee-principal-type User --role "Storage Blob Data Contributor" --scope $stId -o none
'Quarterly report: all good.' | Set-Content C:\azure-lab\hello.txt
Start-Sleep -Seconds 60
az storage container create --name reports --account-name $st --auth-mode login -o none
az storage blob upload --container-name reports --name hello.txt --file C:\azure-lab\hello.txt --account-name $st --auth-mode login -o none
az storage blob list --container-name reports --account-name $st --auth-mode login --query "[].name" -o tsv

You should see this:

hello.txt

Even as Owner you needed a data role, as you saw in Lesson 7. The 60-second pause gives the new role time to apply.

2The old way: a service principal with a secret

Run this:

$sp = az ad sp create-for-rbac --name sp-saat-l10 --role "Storage Blob Data Reader" --scopes $stId | ConvertFrom-Json
$sp | Select-Object appId, displayName, tenant

You should see something like this:

WARNING: The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli

appId                                displayName tenant
-----                                ----------- ------
4f3e2d1c-0b9a-4876-a5b4-c3d2e1f0a9b8 sp-saat-l10 9a8b7c6d-1e2f-4a3b-8c9d-0e1f2a3b4c5d

The secret is in $sp.password. That one string is now a key to your data for a whole year. Sign in with it in a separate CLI session and use it:

$env:AZURE_CONFIG_DIR = 'C:\azure-lab\sp-cli'
az login --service-principal --username $sp.appId --password $sp.password --tenant $sp.tenant --allow-no-subscriptions -o none
az storage blob list --container-name reports --account-name $st --auth-mode login --query "[].name" -o tsv
az logout
Remove-Item Env:AZURE_CONFIG_DIR

You should see this:

hello.txt

3The better way: a user-assigned managed identity

Run this:

$id = az identity create --name id-saat-l10 --resource-group $rgName --tags course=saatvedha-azure lesson=10 | ConvertFrom-Json
$id | Select-Object name, clientId, principalId
az role assignment create --assignee-object-id $id.principalId --assignee-principal-type ServicePrincipal --role "Storage Blob Data Reader" --scope $stId -o none

You should see something like this:

name        clientId                             principalId
----        --------                             -----------
id-saat-l10 7d6c5b4a-3928-4170-8e6f-5d4c3b2a1908 e1d2c3b4-a596-4877-8695-a4b3c2d1e0f9

Notice what’s missing: no password, nothing to store. clientId is for signing in; principalId (the object ID) is what the role points to.

4Let a container use the identity

Container Instances needs its resource provider registered once per subscription. Run this:

az provider register --namespace Microsoft.ContainerInstance --wait
az provider show --namespace Microsoft.ContainerInstance --query registrationState -o tsv

You should see this:

Registered

Now write the command the container will run, and start it:

$cmd = '/bin/sh -c "az login --identity --client-id CLIENTID --allow-no-subscriptions -o none && az storage blob list --account-name ACCOUNT --container-name reports --auth-mode login --query [].name -o tsv"'
$cmd.Replace('CLIENTID', $id.clientId).Replace('ACCOUNT', $st) | Set-Content C:\azure-lab\mi-test.txt
az container create --resource-group $rgName --name aci-saat-l10 --image mcr.microsoft.com/azure-cli:latest --os-type Linux --cpu 1 --memory 1.5 --restart-policy Never --assign-identity $id.id --command-line "@C:\azure-lab\mi-test.txt" --tags course=saatvedha-azure lesson=10 -o none
do { Start-Sleep 10; $state = az container show -g $rgName -n aci-saat-l10 --query "containers[0].instanceView.currentState.state" -o tsv; $state } while ($state -ne 'Terminated')
az container logs --resource-group $rgName --name aci-saat-l10

You should see something like this:

Waiting
Running
Terminated
hello.txt

The container signed in as id-saat-l10 and listed the file. No secret was written anywhere: not in the command file, not in the container settings. Passing the command with @file keeps PowerShell away from its quotes and &&.

✅ Checkpoint: Both the service principal and the managed identity listed hello.txt, and the container’s command file contains no secret.