Transcribed
Entra Workload Identities - Simply Explained
Aug 5, 2026 ·
16m 42s
Download and listen anywhere
Download your favorite episodes and enjoy them, wherever you are! Sign up or log in now to access offline listening.
Entra Workload Identities - Simply Explained
Description
Apps, pipelines and AI agents need access too, yet many still hide passwords in code and config files. In this Simply Explained episode, Mirko Peters gives Azure admins, developers and...
show more
Apps, pipelines and AI agents need access too, yet many still hide passwords in code and config files. In this Simply Explained episode, Mirko Peters gives Azure admins, developers and architects a plain-English map of Microsoft Entra workload identities, managed identities, service principals and federation, plus a practical checklist for securing them.
In this episode
Key takeaways
Worth quoting
“A workload identity is different. It's a digital badge for software. That software could be an app your team built an automation that runs on a schedule, a background service, or even an AI agent” – Mirko Peters (01:25)
“So when you hear these names keep this map in your head, the application registration is the app's master design. The service principle is its working identity inside your company.” – Mirko Peters (06:41)
Explore more on M365.FM
Follow and rate M365.FM in your podcast app, and join the free M365 community at m365con.net.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-azure-cloud-power-platform-ai--6704921/support.
show less
In this episode
- 00:00 – Intro: who signs in when software needs access?
- 00:53 – User identities and workload identities
- 03:19 – App registrations, service principals and managed identities
- 07:09 – What happens during a token request
- 10:30 – Security rules for workload identities
- 14:06 – Picking the right pattern and a workload identity check
Key takeaways
- Workload identities give applications, automations and AI agents their own Entra identity instead of shared service accounts or passwords in code.
- An application registration is the app's global design, a service principal is its local identity in each tenant, and a managed identity is a service principal that Azure manages for an Azure resource.
- Prefer managed identities inside Azure and workload identity federation outside it, use certificates over client secrets, grant minimal permissions and give every workload identity an owner.
Worth quoting
“A workload identity is different. It's a digital badge for software. That software could be an app your team built an automation that runs on a schedule, a background service, or even an AI agent” – Mirko Peters (01:25)
“So when you hear these names keep this map in your head, the application registration is the app's master design. The service principle is its working identity inside your company.” – Mirko Peters (06:41)
Explore more on M365.FM
- Episode page: the full episode with chapters, quotes and a workload identity FAQ
- Microsoft Entra ID – acts as the reception desk that authenticates workloads and issues short-lived tokens
- Azure Key Vault – holds the secret a logic app reads using its managed identity
- Azure Logic Apps – serves as the running example of a workload with a managed identity
- Related episode: Entra ID Governance: Access Reviews, Entitlement Management and Lifecycle Workflows
Follow and rate M365.FM in your podcast app, and join the free M365 community at m365con.net.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-azure-cloud-power-platform-ai--6704921/support.
Information
| Author | Mirko Peters M365, Azure & AI |
| Organization | m365 FM |
| Website | - |
| Tags |
Copyright 2026 - Spreaker Inc. an iHeartMedia Company
Comments