Research seriesL2paper
Managed identities and federated identity credentials remove the secret from a workload's sign-in, and with it the threats people know how to watch for. This series studies what replaces them: why the resource an identity is attached to becomes the credential, why federated credentials form a trust path that has no expiry, no secret to scan and no policy control, and why removing a managed identity's access can take hours. Grounded in Microsoft Learn's managed identity and workload identity federation documentation, the Microsoft Graph credential and policy references, OAuth 2.0 and JWT standards, and NIST SP 800-207.
A managed identity has no secret to steal, so the question shifts from who holds the key to who can run, change or attach code where the identity lives.
Federated identity credentials remove the secret, and with it the expiry dates, scanners and policies credential governance was built on. What replaces them has to be designed.
Removing a managed identity's role, its group membership or even the identity itself does not end its access at once. Here is where the delay lives, and how to plan around it.