Managed Identities for Azure Resources is a feature of Azure Active Directory. There are several Azure services that support Managed Identities for Azure Resources. For those who build cloud applications, management of credentials within a code for authenticating to cloud services is often a common challenge. It's critical to ensure credentials are kept secure. As a matter of fact, preferably, credentials should never appear on a developer's workstation, nor should credentials ever be checked into source control. With Azure Key Vault, administrators have a way to securely store credentials. However, to be effective, the application code needs to authenticate to Key Vault to retrieve those credentials that are stored. Enter Managed Identities for Azure Resources. Using the Managed Identities for Azure Resources feature in Azure AD solves this problem. This solution provides supported Azure services with an automatically managed identity in Azure AD that can be used to authenticate to any service that supports Azure AD authentication without the need to store any credentials in code. Key Vault is one of the Azure services that is supported. Managed Identities for Azure Resources is a free feature that comes with all Azure AD editions. There are two types of managed identities to choose from. 

They include a system-assigned managed identity and a user-assigned managed identity. A system-assigned managed identity is enabled directly on an Azure service instance. Once the identity has been enabled, Azure will create an identity for the instance in the Azure AD tenant that's trusted by the subscription of the instance. The credentials for the identity are provisioned onto the instance after the identity had been created. System-assigned identities are tied to the Azure service instances that they are enabled on. Deleting an instance with a system-assigned managed identity attached to it will cause Azure to automatically clean up the credentials, along with the identity in Azure AD. A user-assigned managed identity is essentially a standalone Azure resource. Via a creation process, Azure creates the identity in the Azure AD tenant. The subscription in use, in turn, trusts the identity. An identity, once created, can be assigned to one or more Azure service instances. Unlike a system-assigned managed identity, the lifecycle of a user-assigned identity is managed separately from that of the Azure service instance, or instances, to which it's been assigned. Application code can use managed identities to request access tokens for services that support Azure AD authentication. Azure will handle the rolling of the credentials that are used by the service instance.