Plan and Implement Workload Identities (20–25%)
Workload identities are the non-human identities: managed identities, service principals and the apps behind them. This domain also covers integrating enterprise and on-premises apps, registering your own apps, and watching cloud app usage with Defender for Cloud Apps. Microsoft weights it at 20–25%.
The examples follow Northwind's platform team, which runs Azure Functions, a VM scale set, an on-premises timesheet app and a homegrown Orders API.
Choosing an Identity for a Workload
| Identity | Credential management | Lifecycle | Use for |
|---|---|---|---|
| System-assigned managed identity | Azure handles it | Deleted with its resource | One Azure resource that needs access |
| User-assigned managed identity | Azure handles it | Standalone, shareable | Many resources, pre-authorised access, resources recreated often |
| Service principal (app registration) | You manage a certificate, secret or federated credential | Until deleted | Apps outside Azure, multitenant apps, CI/CD (prefer workload identity federation) |
| User account | Password | Until deleted | Avoid for automation |
| Managed service account (gMSA) | AD rotates it | AD object | On-premises Windows services |
Authentication with a managed identity is automatic; authorisation still comes from Azure RBAC role assignments (or Entra roles or app roles) at the right scope.
Example: a Function reads Key Vault; a scale set reads storage.
Function app ── system-assigned MI ──RBAC: Key Vault Secrets User──▶ Key Vault
VMSS (instances come and go) ── user-assigned MI (created first) ──RBAC: Storage Blob Data Reader──▶ StorageTakeaway: "deleted with the resource" means system-assigned; "shared or pre-authorised" means user-assigned; 403 means a missing role assignment.
Enterprise Applications
An enterprise application is the service principal of an app in your tenant: gallery SaaS apps, your own registrations, and app proxy apps.
- Properties: Assignment required (only assigned users/groups can get tokens; My Apps shows the app only to them), Visible to users, owners.
- SSO modes: SAML, OpenID Connect/OAuth, password-based, linked, header-based. Provisioning (SCIM) creates and removes accounts in the SaaS app.
- Roles to manage apps: Application Administrator (everything, including application proxy), Cloud Application Administrator (everything except application proxy), Application Developer (create registrations).
- Collections group apps into sections in My Apps.
- Consent: user consent settings (none, verified publishers with low-impact permissions, or all), permission classifications, and the admin consent workflow for requests routed to reviewers.
Unlock with a paid plan
1 more section (about 387 words) continue below. Every paid plan unlocks all SC-300 study guides, the full question bank and mock exams, from $4.97/month.