Watch · narrated whiteboard episodesL2
Managed Identity and Federated Credential Security
Managed identities and federated identity credentials remove the secret from a workload's sign-in, and with it the threats people know how to watch for. This series studies what replaces them: why the resource an identity is attached to becomes the credential, why federated credentials form a trust path that has no expiry, no secret to scan and no policy control, and why removing a managed identity's access can take hours. Grounded in Microsoft Learn's managed identity and workload identity federation documentation, the Microsoft Graph credential and policy references, OAuth 2.0 and JWT standards, and NIST SP 800-207.
-
21 min
Episode 1The Resource Is the Credential: Who Can Become a Managed IdentityWhy a managed identity's credential becomes the resource itself: the documented boundary, four paths into the effective principal set, why sharing takes the union, what logs can and can't attribute, and how agents change the picture.
-
21 min
Episode 2Credentials Without Secrets: Federated Identity Credentials as an Unwatched Trust PathWhy federated identity credentials escape secret-based governance: the three missing properties, a documented property-by-property comparison, the three-hop trust path, quiet failure modes, a trust-path register, and what agents change.
-
19 min
Episode 3When Removing Access Doesn't: Token Caching and the Revocation Window for Managed IdentitiesWhy removing a managed identity's access takes hours to take effect: locally checked tokens, five documented behaviours, a layered view of stale access, the four removal actions, design rules, containment steps and the agent kill switch.