Managed identity inside Azure, workload identity federation outside it. Three of the four lanes hold no credential at all, which removes rotation, storage and leakage as problems rather than managing them.
A federated credential is bound to an issuer, a subject and an audience. For GitHub that subject is repo and environment, so a workflow on a feature branch cannot obtain the production deploy identity.
The pipeline identity holds no standing Azure role either: it federates, activates through PIM for 60 minutes, deploys, and expires (view 21).
Governance of non-humans
Every workload identity has an owning group and an annual review. 3,400 of them outnumber administrators eighteen to one, and ungoverned they become the largest standing privilege in the estate.
One identity per workload, never one shared identity per team. Shared workload identities make the audit trail useless precisely when it is needed.
Azure Policy denies the creation of a new application secret in production subscriptions, so the exception lane cannot grow quietly.
The exception lane
170 service principals still hold client secrets, held in Key Vault and rotated on a 90-day SLA. They exist because their targets cannot federate.
Each has a named owner and a target date. The burn-down is reported monthly; without a date this lane becomes permanent.
Conditional Access restricts these principals to named locations (view 13), so a leaked secret used from elsewhere is blocked rather than merely detected.
