Azure Managed Identity and Zero Trust

Question

Azure Managed Identity provides a mean to only allow explicitly defined users/apps to access a given resource. For instance I can setup that no-one can access my database except the Managed Identities A and B. If C (or someone with no identity) tries to access the database, they are blocked. Even if they have the connection string (as I understand it).

But how does this play along with the Zero Trust principles. Particularly the Verify Explicitly, which is here described by Microsoft:

Always authenticate and authorize based on all available data points, including user identity, location, device health, service or workload, data classification, and anomalies.

This makes it sound like you always have to have some sort of built-in access control in your application (or database), using something like tokens or username/password.

But if that is the case, then what is Managed Identities meant for? An extra security layer, in case someone steals the access credentials? Or have I completely misunderstood Zero Trust and/or Managed Identities?

Answer 1

If you would take Zero Trust to its extreme, you would not be able to use tokens to verify the authorization of a user, because when using a token you have to trust the service that issued the token that they did a good job in establishing the identity of the user.

As a comparison, Azure Managed Identities can be seen as a token for a service within your software ecosystem. You can use it to verify that the service is authorized to perform certain actions. But you have to trust the Azure base system that they only hand out this token to the service that has the right to use it.

But if that is the case, then what is Managed Identities meant for?

It makes it possible to apply the Zero Trust principle (in a workable form) also to interactions between different services in your application, especially where those interactions are not related to a single user who is now interacting with the application (and for that reason, cannot be asked to authenticate themselves).

The database server doesn't have to trust that it is the login service that is requesting a bunch of passwords. Instead, it can use the provided id to establish that the requesting service has the right to retrieve those passwords.