Managed identities: system-assigned vs user-assigned, and assigning them Azure RBAC roles

Applications running in Azure often need to call other services, such as reading secrets from Azure Key Vault or files from a storage account. Storing a password or key in code or configuration is risky: it can leak and must be rotated. Managed identities solve this by giving an Azure resource an identity in Microsoft Entra ID whose credentials Azure creates, stores and rotates automatically. Your code never sees a secret.