Managed identities: system-assigned vs user-assigned, and replacing stored secrets with token-based access

Applications often need to call other services: an App Service reading from Key Vault, a VM writing to Storage, a Function querying Azure SQL. The old way was to store a connection string, key or client secret in configuration, which can leak, expire or be forgotten in a code repository. A managed identity solves this by giving the Azure resource its own identity in Microsoft Entra ID, whose credentials Azure creates, stores and rotates for you. Your code never sees a secret.