Originally published on DevToolHub .

Most Azure managed identity vs service principal debates start from a false split. A managed identity is a service principal. Microsoft's docs say Azure creates a service principal of a special type in Entra ID for every managed identity. The real question is who looks after the credential: Azure or you. Below you get the rule for choosing, the commands for both, and the gotchas that appear after the first deploy.

I built this from Microsoft Learn and the Azure CLI reference as of November 3, 2026. I haven't run every command against a live tenant, so test them in a sandbox subscription first.

Azure Managed Identity vs Service Principal: What Is the Difference?

A service principal is the identity an application uses to sign in to Entra ID and receive Azure permissions. A managed identity is a service principal whose credential Azure creates, stores and rotates for you. You can never read it.…