System-assigned vs user-assigned managed identity
Verdict: A system-assigned managed identity is tied to one resource and deleted with it. A user-assigned managed identity is a standalone resource shared across many and outliving each, so it keeps permissions as machines are recycled.
| Criterion | System-assigned managed identity | User-assigned managed identity |
|---|---|---|
| Lifecycle | Shares the resource's lifecycle, deleted with it | Independent, standalone Azure resource |
| Sharing | Tied to one resource only | Associated with many resources |
| Choose when | One resource needs its own identity, auto cleanup | Several resources share an identity that must persist |
Rules
- A user-assigned managed identity is a standalone resource with an independent lifecycle that can be shared across multiple Azure resources.
- A system-assigned managed identity shares its lifecycle with its resource and is automatically deleted when that resource is deleted.
- A legacy service principal represents an app created before app registrations existed, with editable credentials but no associated app registration.
Traps
- Staying in the directory for reassignment describes a user-assigned identity; a system-assigned one is removed with its resource, not retained.
- A system-assigned identity cannot be shared across several VMs; when resources are recycled but permissions must persist, use a user-assigned identity.