For years, security meant a strong network edge: a firewall at the boundary, a trusted inside, a hostile outside. In a cloud estate that model quietly stopped describing reality. Your services talk to each other and to Azure's own APIs over the public backbone, authenticated by tokens. The firewall still matters, but it stopped being the front door a while ago. Identity is the door now.
That shift changes where the security effort pays off. Four things carry most of the weight.
Managed identities instead of stored secrets. If a service authenticates with a credential sitting in config or a pipeline variable, that credential leaks eventually — into a log, a repo, a screenshot. A managed identity has nothing to steal. Azure issues and rotates the credential, and your code never sees it. In Terraform it's a few lines:
resource "azurerm_user_assigned_identity" "app" {
name = "app-identity"
resource_group_name = azurerm_resource_group.app.name
location = azurerm_resource_group.app.location
}
resource "azurerm_role_assignment" "app_reads_storage" {
scope = azurerm_storage_account.data.id
role_definition_name = "Storage Blob Data Reader"
principal_id = azurerm_user_assigned_identity.app.principal_id
}
The app authenticates as that identity and gets exactly the access you granted, with no password anywhere.
Conditional Access as the real gate. Who is signing in, from where, on what device, at what risk level, and what they must pass to get through. That policy layer decides more about your posture than any network ACL. It's where "require multifactor for admins" and "block legacy authentication" live.
Just-in-time admin over standing access. Privileged Identity Management lets a role activate for an hour when it's needed and expire on its own. Permanent Owner assignments are the thing an attacker hopes to find, because they never have to move fast. When nobody holds standing god-rights, a stolen session is worth far less.
Least privilege that stays maintained. A custom role you can explain in a sentence beats a pile of Owner grants nobody remembers approving. The aim is permissions you can reason about, not total lockdown for its own sake.
The uncomfortable part for a lot of estates: you can run a beautifully segmented network and still be one leaked key away from a breach. The segmentation is worth having. It just isn't where the fight is any more. Identity is where an attacker gets in or gets stopped, so it's where the design attention belongs.
The full, runnable version is in the blog-examples repo.
Next: why your architect should be able to tell you what the design costs before anything ships.