Workload identity federation over managed identity with pod identity: the pod's projected service-account token is exchanged for an Entra token, so nothing long-lived exists on the node and there is no node-level identity to escalate to.
Token validation happens at API Management, not in each service. JWT validation, scope checks, tenant claim extraction and quota become one reviewable policy artefact rather than middleware repeated seven times.
Key Vault holds only third-party credentials for downstreams that cannot speak Entra. Every entry in it is an exception with an owner and a rotation schedule, which keeps the list short enough to audit.
Token handling
Client tokens are 60 minutes; service-to-service tokens are cached in memory for their lifetime minus a 5-minute skew and are never written to disk or logs.
Secrets resolved from Key Vault are cached in memory for 10 minutes only, so a rotation propagates without a deployment and a compromised pod's window is bounded.
The tenantId claim is mandatory. A request without it is rejected at the gateway, which is what makes the isolation model in view 29 enforceable rather than aspirational.
Risks
API Management is a single enforcement point and therefore a single point of failure for authorisation. It is zone redundant, and services still validate the tenant claim defensively rather than trusting the header.
Federated credential misconfiguration is subtle and hard to spot in review: a wrong subject claim can silently widen access. It is covered by policy-as-code checks in the pipeline.
Partner webhook HMAC keys remain the one long-lived shared secret. 90-day rotation, Key Vault stored, and flagged as the weakest link in the identity design.
