>> Hi this is Steve Michelotti
of the Azure Government Engineering team.
I'm joined here today by Mohit Dewan,
my colleague also on
the Azure Government engineering team. Welcome Mohit.
>> Thank you, Steve. Good to be here.
>> So today, we're going to talk about
Managed Identity on Azure government.
So, why don't we start out just tell
us what is Managed Identity? Why do we care?
>> It's great. So, Managed Identity is the way to
assign identities to resources in Azure government,
in Azure, in general including Azure government.
>> Okay.
>> We can use the resources with these identities can then
authenticate to other resources in Azure that do
support authentication via Managed Identities.
>> Okay. So instead of a user authenticating a resource,
it's actually a resource authenticating your another resource.
>> Exactly.
>> Okay. I got it. All right so,
now we understand the mechanics of it.
Let's talk about some real-world scenarios for Managed Identity.
>> Yeah. I know, it's great. So, anytime
we write applications in Azure,
most of the times,
we need to rely on other Azure resources to do something.
So for example, you're writing
a web app and let's say you're doing something,
some cloud operations against the database,
you need to connect to the database.
So, the traditional way or the common practice has been either we
store all our connection strings and
whatever other secrets we need as config in our app,
and this can get messy because we definitely don't
want config to be checked in to the source, right?
Something a bit better would be and we can store
these secrets either in config or in
the Azure portal but bottom line,
they have to be in plain text somewhere
and anyone who has access can see it.
>> Right.
>> One step better than that is you can use
key vault to store all these resources and then
grant access to other resources that need
access to secrets and whatnot, connection settings.
But again, you need a way to access the key vault and for that,
you need either a secret or you search base authentication.
So, you still need to store at least one thing
somewhere so you can authenticate,
your application can authenticate the key vault and go on.
>> Right.
>> Managed Identity lets you circumvent that.
So, because your application has its own identity,
you don't need to store any credentials anywhere,
and you can still use our back and whatnot and key vault or
other resources that support MI
to do the authentication and authorization.
>> Okay. So, if I summarize what you're saying,
we have a simple web app to talks to
a database kind of a canonical example.
I could put that connection string in
my config as you said, not ideal.
We could put it in an environment variable.
Again, not ideal.
Could put it in key vault,
much better but even then,
we still need some configuration to access the key vault.
>> Exactly.
>> Okay. I got it.
>> We want to get away from that as well.
>> So, this sounds like a lot- like the stuff I
did in the early 2000s where we would
set up IIS service principle to
talk to SQL Server database like Windows authentication to
be able to have
the web app process
be able to talk to the database instead of a user,
is that sort of an okay analogy?
>> Yeah, that's a good analogy
and you don't need to do that anymore.
>> Okay.
>> You can use Managed Identities.
>> What's old is new, what's new is old. All right.
>> Yes.
>> Great. All right, cool.
So, let's talk about some of the mechanics of
how we actually implement this in Azure Gov.
>> Yes. So, let's talk about Manage Identities itself.
>> Yes.
>> There are a couple of different kinds of Managed Identities.
We have system identities and we have
user assigned managed identities, right?
We'll talk about where each one of these is
useful as well but system assigned,
literally each resource that is
enabled with Managed Identity, gets an identity.
So, in user assigned,
you create a user assigned managed,
a user of managed entity in AD and then you can
assign that Managed Identity to multiple resources.
>> Okay.
>> It will be scenarios of each one of these.
>> Right. Now, that's great. So, let's assume that you have
10 VMs that need to access a key vault and pick up I don't know,
some connection string or
secret that they need for
whatever workload they are run for, right.
So, if you use system assigned Managed Identity,
you will need to enable the Managed Identity on each VM.
So, you'll have to do it 10 times.
>> So, that would be a pain.
>> Yes, right. Then again, in key vault,
you'll have to go and be like, "Hey,
add this VM," 10 times, right.
But if you do user assigned Managed Identity,
you create one Managed Identity that you assign to
all these 10 VMs and then there's only one identity that
you add to key vault and it streamlines the process.
You only have one identity to manage which makes
sense because you want all
of these resources to have
the same identity to access
just one thing or perhaps, other things.
>> Yeah. All right makes sense. So, depending on your scenario,
it's more appropriate to use.
System assigned or user assigned, you have the flexibility.
>> Yes. Well, it's a great feature.
>> Okay.
>> So, let's talk about how we use Managed Identity, right?
So first of all,
we want to make sure that the resource that we want to assign
Managed Identity to actually supports Managed Identity.
>> Okay. So, we're not a 100 percent there yet.
>> Yes.
>> Okay. Getting there.
>> We're getting there, we're getting better.
Every month perhaps but we're not 100 percent, yes.
>> Okay.
>> A couple of examples are virtual machines that
support Managed Identities in Azure government,
in Azure commercial and government.
>> Of course, key vault supports it which is really important.
>> Yes.
>> Yeah.
>> Key vault has the other thing I was thinking of,
app services and functions, right.
So, they support manage-
>> They use course services that we're used to using all the time.
>> So, that's number one over here.
We want to make sure the resource you want to use does support.
You can actually enable and you can assign
an identity resource, right?
The second thing is the Azure service
that this resource needs
to authenticate too should support AD authentication.
>> Okay.
>> Right. So, one example is key vault,
it does support AD.
There could be other similar things where we need to authenticate
to and then do whatever the workflow is, right?
Once we know that we have a resource for our MI is
supported and we have another Azure resource that supports AD,
we can light up our Managed Identity scenario.
So, the step number three,
the next thing is to enable Managed Identity on
the resource and we can do this using the portal,
we can do this using PowerShell,
we can do this using the CLI, it's easy.
>> Okay.
>> That's usually a one line and we'll get to that in the demo.
>> So question. So, what if I have
a resource that doesn't support Managed Identity,
am I out of luck or is there any alternative I have?
>> That's a great question.
So, one example is cosmos right
now which doesn't support Management Identity directly,
but you can get around it.
You can work around it by using the key vault for example.
So, you can store your cosmos connection string or secret in
key vault and then your app can authenticate to key vault,
get the secret and then connect to Cosmos.
>> Okay. So, that's still way more secure than having to put
the cosmos connection string directly in
my configuration or my environment perhaps.
>> Absolutely.
>> Okay. Awesome.
>> Yes. Number four,
we assign whatever appropriate our back roles that you
want to delegate for your service or
maybe you can only look at secrets in the case of key vault,
or only keys, or search,
and so on, or everything, right?
Lastly, you need to make
some code change in your application so you can use
Managed Identity rather than using whatever servers
principles or something else you may have
configured and we'll walk through that.
>> Okay. Sounds good. So, any things we need to
be aware of for Azure government or is identical to commercial?
>> There's really one nuance.
The portal support isn't quite there yet like Azure commercial.
>> So, partial support.
>> Yes.
>> Okay.
>> So, it's limited. So for example, in the case of VMs,
you don't see Managed Service Identity in the portal,
but you see it in Azure Commercial.
That doesn't mean it's not there, it's there,
we just have to use either the CLI or the
PowerShell and we can still do it.
>> Sounds good.
>> Okay. So, we have a couple of demos lined up.
>> Okay. So, once you set up these demos here,
what are you about- it looks like you have two demos to show us.
Just give us a sentence about each ones,
so we know what you're about to show us.
>> Yes. So, I wanted to separate it out into
an IaaS scenario and a PaaS scenario.
So, for the IaaS scenario,
we're going to use a virtual machine which we'll
assign a Managed Identity to and
then use that identity to read
a secret from the key vault and we'll of course,
in the policies in key vault,
we'll create a new policy so that
this new identity is authorized to read the secret.
The second thing is a PaaS scenario where we have a web app.
So, we'll create a web app and we'll enable the managed identity.
We'll do the same thing where we go read a secret from
the key vault but we're doing
it in the PaaS surveys that we're at.
>> All right, great. So, infrastructure as
a service, platform as a service.
We have customers who do both these things,
it works in both scenarios.
So, let's jump into it, sounds good.
>> Perfect. So, I have a VM setup and you can see my VM over here.
This is the VM I just set up yesterday,
it's called MI demo.
>> Okay.
>> It's just a Vanilla VM.
It has Visual Studio installed on it.
>> Okay. Let's see.
Just in the Azure government portal and it's just a regular VM.
>> Yes.
>> All right cool.
>> What I have done is
run this one command line and I did this prior to the demo.
>> Okay, great.
>> Where we are simply enabling Managed Identity on this VM.
>> Oh, that's an interesting point. So, it's not
just on by default everywhere.
To minimize those surface area,
you explicitly are meant to enable it.
>> Yes.
>> All right, cool. It makes sense.
>> Over here, G is the resource group and N is the name of the VM,
which is MI demo which you can see over here.
>> Okay.
>> We can see over here it says,
"systemassignidentity" So, search enabled.
Now, let's go ahead and use it.
>> Okay.
>> Right. So, we'll go back.
This is a key vault that I have set up.
I'm looking at the access policies,
the key vault and if I refresh,
you don't see the VM name over here.
>> Okay. So, no smoke and mirrors is definitely not there.
>> It's not there and let's prove it that it's not there.
So, what we'll do is we'll go back to the VM and we
will try to execute some code that accesses the key vault.
>> Okay. So now, you've remote desktop into the VM.
You're on the VM running
a code trying to access the key vault. All right.
>> Yes. So you can see over here,
the first two lines are simply trying to get a
token that can be used to access the key vault.
This key vault URIs,
it's just a secret,
it's the demo secret we're trying to access.
>> Okay.
>> So, I'll simply hit "F5" and let's see what happens.
So, we get an error over here.
So, we get a "Forbidden Exception,
this VM cannot read that Key Vault," yet.
>> Okay.
>> All right, this piece of code.
>> Make sense.
>> So, let's get out of this.
Let's go back to the "Access Policies" in the "Key Vault,"
and what we'll do is we will add the "VM."
>> Okay.
>> So that we can actually run that little snippet of code.
So, we'll say "Add New" and we're trying to read a "Secret,"
so we're just going to say "Secret Management."
Here is where we start looking for the "Managed Identity" that
was created for the "VM" using the "CLI Command" I showed you.
So, the "VM" name is "mi-demo,"
so we select that.
We hit "Select," we hit "OK,"
we hit "Save," and you can see it's there now, it's updated.
So, we can "Refresh" it's there.
>> Okay.
>> Let's go back to the "VM" and let's
execute that same snippet of code,
and this time we should be able to print the "Secret."
We should be able to read it and print it out.
So, I have five again and you'll
see if I go back to "Secret." It's "Yummy Gelato."
>> Okay, great. So, we didn't have to put
any secret configuration in our console app,
we just gave permission to
the "Managed Identity" right for the "VM" itself.
>> Yes.
>> Okay. Awesome!
>> Very easy.
>> Very cool.
>> Okay. So, that's the first demo we had.
The second demo, we look at the "App Service."
>> All right, the PaaS demo. Yeah.
>> Yes. So, we'll go back to the
"VM" and what I'll do is I'll create the "App Service" first.
>> Okay.
>> Last time, we used the CLI.
This time, we're going to use the portal because
the portal does support Manage Identities in Azure Government.
>> Sounds good.
>> Okay.
>> So, no VM, in this case,
we're just using a PaaS App Service.
>> Exactly.
>> Okay.
>> Exactly. So, we'll go to "App Services."
I already have a plan set up so we'll use the same plan,
but let's go ahead and add an App Service.
So "Web App," let's call it "mi-demo3."
>> Of course, we all have our demos, "mi-demo21." Okay.
>> Let me have an existing.
>> Pre and existing resource group.
>> Yes. I have an existing plan, I'll use that.
>> We can see the US Gov Virginia Data Center.
>> Yes.
>> Okay.
>> So, they should get done pretty quickly.
>> Okay.
>> Once it's done, we'll go
back and look for "Managed Service Identity,"
so we can turn it on.
>> Okay. So, right now,
this is just creating an empty blank website.
>> Exactly.
>> You're going to upload code to this website.
>> Exactly.
>> Okay, got it. So, while that's
working, you want to show us the code?
>> Yeah, that's a great idea.
So, we can go back,
it's pretty much it,
template, and we see app that I set up.
There's nothing, literally nothing,
I've only added three lines of code.
>> Got it. So, it's not a console app anymore.
It's actual web app and we see C# app.
Although it looks somewhat similar to the console app in
terms of those three lines of code accessing the "Key Vault."
>> Yeah.
>> Okay.
>> That's just to show that we can access the "Key Vault."
>> We're getting the secret and sending it in to the views.
>> Yes.
>> So, we can display it on the web page.
>> Exactly.
>> Okay.
>> So, I hijacked, maybe "About" section, that's about it.
>> Okay, make sense.
>> Just to show this as a demo.
So, let's go back and check if the web app is created.
"Validation". I think it's still doing it. Let's see.
>> So, it "Refresh" there.
>> Yeah, it's here.
>> There it is, demo3.
>> Its running.
>> Cool.
>> So, this is Managed Service Identity, right?
If you click over here,
it's "Off" by default.
>> So, this is the case where the VM didn't have displayed.
>> Right.
>> It just so happens to be enabled in web apps,
so we don't have to use a CLI,
we can do it from here. I got it. Okay.
>> Yes. So, all we do is we simply say "On."
>> Yeah.
>> We hit "Save". We'll give it a few seconds and it should,
its registering it with AAD.
It should enable it. The identities being created.
>> Yeah.
>> In the meantime, what we will do is we will download
the Publishing Profile so we can publish our code to this web app.
>> Or you could just deploy directly from
Visual Studio even without the Publish Profile.
>> Yes.
>> Either way.
>> Okay.
>> All right. So, you just downloaded
the Published Profile from the portal,
you import it in Visual Studio and this
gives you the connections and credentials
you need to be able to deploy directly from Visual Studio,
which is one of the few ways we opt, we support.
>> Yeah. Pick your way how are you want to do it.
>> Okay.
>> What's going to happen is,
it's going to publish it, but it's not going to work.
>> Right.
>> Because, remember we haven't told Key Vault,
"Hey, this web app can access you."
>> Makes sense. All right, so let's approve that.
>> So, we can go back,
we can hit "About,"
which is what we hijacked,
and we'll see some kind of an error should
come up over here. Right.
>> Because we're on the server,
you won't tell us the exact details, but yeah.
>> We can put this
to development and we can see the stacking rank.
It's going to be the same as what we saw
in the console app, it's forbidden.
>> Right. Exactly. Okay.
>> Now, let's go back to the "Key Vault."
Find my "Key Vault."
I think I lost my "Key Vault." Let's go back there.
>> That's all right.
The thing there, Azure portal's easier to navigate.
>> Yeah. Okay. So, that's my
"Key Vault" and lets go back to "Access Policies."
We're going to "Add" one more for "mi-demo3."
So, again, we're only looking at "Secrets,"
and let's search for our "Web App."
Okay. So, it's the second from last.
>> Okay.
>> It's the one we just created.
We enabled them as ion.
>> The exact same user experience,
whether I was a VM or a PaaS web app.
It's just a service principle.
>> Exactly.
>> Okay.
>> So, we're done we're going to hit "Save,"
and now, you can see it's over here.
>> Okay.
>> So, now, let's go back.
Let's actually go from here.
This is what we created,
so let's open this.
We'll go to "About,"
and we should see this work this time.
>> Okay.
>> We should be able to see the credential and we can.
>> There it is.
>> Yeah.
>> Aware this time. Okay, very cool.
>> So, it's very easy to set up,
very easy to use.
I'm super excited because
all the code I have where I'm using service principles.
>> Yeah. As developers,
the last thing we want to do is how to manage these secrets.
We don't want to get in trouble for that.
Just take that out of our hands completely and take it easy.
>> If you have search,
then you have to worry about rotating them,
whatever time period you have set up.
Six months, two years,
whatever, don't want to do that.
>> All right, awesome.
>> Great.
>> All right. It looks good. All right.
So, we've seen examples of IaaS
and PaaS using Managed Identity on Azure Government.
Okay. This has been Mohit with Steve Michelotti from
the Azure Government Engineering team talking about
Managed Identity on Azure Government.
Thanks for watching.
>> Thank you.