►
Description
This month’s in-depth topic: Secure DevOps with the Microsoft Identity platform. Build, deploy and run code and infrastructure without exposing sensitive information such as keys or secrets. Any platform, any language! This session was delivered by Christos Matskas - Sr Program Manager (Microsoft) | @ChristosMatskas. Recorded January 20, 2022. Q&A in chat and at end of call.
Stay connected – (all groups) (Blog and YouTube posts)
• Twitter https://twitter.com/microsoft365dev and @azuread
• YouTube https://aka.ms/M365DevYouTube (Developer channel) and https://aka.ms/m365pnp/videos (Community channel)
• Blogs https://aka.ms/m365pnp/community/blog
• Recurrent Invite https://aka.ms/IDDevCommunityCalendar
• Join us for the next Microsoft Identity Platform community call on February 17th at 9:00am PT
A
I
don't
know
if
you're
particularly
tuned
with
everything,
but
maybe
you
heard
that,
maybe
a
week
ago,
maybe
10
days
ago,
somebody
that
is
very
prominent
in
the
node
community
out
of
spite
just
to
show
that
open
source
should
be
consumed
in
a
different
way
decided
to
update
all
his
npm
packages
and
published
empty
code.
So
there
was
no
code
in
his
packages.
The
problem
with
that
was
that
a
lot
of
software
out
there
was
dependent
on
those
external
packages
to
work
and
with
that
action
he
took
down
everything.
A
In
my
in
my
capacity,
I
try
to
educate
developers
on
how
to
build
better
software
and
more
secure
software,
but
security
comes
in
a
lot
of
layers
and
law
of
components,
so
one
layer
could
be
how
you
write
your
code
and
how
defensive
your
code
is
against
attacks,
but
then
again,
there's
another
layer
on
how
you
deploy
and
run
your
code
in
production.
And
what
can
you
do
to
secure
against
it
and
then
there's
all
these
other
layers
on
everything
else
and
even
in
secure
devops.
A
A
We
do
have
a
hackathon
next
week
that
talks
about
the
centralized
identity.
If
you
haven't
worked
with
decentralized
adventure,
you
don't
know
what
it
is.
We've
already
put
some
videos
out
there
on
youtube
and
we
did
a
couple
of
streams
on
the
45
so
that
introduce
people
to
decentralized
identity.
This
is
a
way
that
we're
trying
to
transform
how
users
issue
and
verify
credentials
that
they
can
use
in
in
the
world
out
there,
and
especially
with
web3
and
the
decentralization
of
everything
identity
is
a
major
component
of
that.
A
If
you
want
to
learn
how
to
build
things
or
if
you
want
to
see
how
the
apis
work
make
sure
to
join
our
hackathon,
we
have
some
pretty
awesome,
swag
out
there
we'll
be
adding
more
and
they
have
samples.
So
everything
should
be
easy
for
you
now.
If
you
want
to
learn
more
about
identity
and
security,
we
also
do
a
bi-weekly
show
on
the
45,
so
we
do
have
a
stream.
All
the
content
also
is
available
for
you
on
youtube.
So
if
you
search
on
youtube
for
45,
so
you'll
find
all
our
content
again.
A
We
try
to
provide
end-to-end
scenarios
on
how
you
build
with
security,
and
even
though
we
are
on
identity
and
focused
on
microsoft
identity.
We
also
show
you
how
to
build
with
any
platform
in
any
language.
So
the
idea
there
is
that
we
expect
you
or
we
want
you
to
come
as
you
are
right,
so,
whether
you're
building
for
azure
or
on
azure
or
whether
you're
building
on
other
infrastructure
or
multi-cloud,
the
challenges
are
consistent.
A
So
you
know
I
might
be
talking
about
key
vault
today
and
service
principles,
but
these
ideas
and
these
principles
do
apply
to
other
things.
So
if
you
don't
use
a
keyboard,
then
you
should
be
using
something
like
hashicorp
keyboard
or
other
tools
that
allow
you
to
store
things
securely
and
since
the
challenges
are
the
same,
and
since
we
want
to
support
everyone
out
there,
this
slide,
sometimes
it's
fairly
controversial.
A
Considering
that
the
only
microsoft
thing
that
you
see
here
is
identity,
but
we
want
to
make
sure
that
developers
are
successful
and
enterprises
are
successful,
no
matter
where
they
run
so,
whether
you
use
bitbucket
or
whether
you
use
git
labs,
whether
you
use
intellij
and
python,
to
develop
your
code
and
if
you're
running
on
aws
or
google
cloud
or
dissolution,
it
doesn't
really
matter
on-prem
and
for
languages.
You
know
that
microsoft
is
an
avid
advocate
of
a
lot
of
different
languages
outside
the
dot
net
ecosystem.
A
So
we
have
an
open
jdk
that
we
developed
these
days
for
java
developers
and
we
contributed
python
and
javascript
typescript
is
our
our
extension
on
top
of
javascript.
So
it
just
goes
to
show
that,
even
though
you
know
we
do
have
first
party
tools,
we
also
want
people
to
be
successful
when
they
use
other
platforms,
and
the
hope
is
that
we
help
you
write
better,
more
secure
software
and
finally,
it
doesn't
really
matter
whether
you're
running
serverless,
kubernetes
or
bare
metal.
The
the
security
principles
should
be
the
same.
A
A
There
are
some
added
benefits
when
you
work
with
our
tooling,
because
everything
is
integrated,
as
I
will
show
in
a
little
bit,
you
can
write
code
that
runs
in
visual
studio
code
and
uses
vc2
code
credentials
to
authenticate
against
the
max
of
365
platform
or
other
services
without
having
to
pass
any
credentials,
and
we
also
have
a
bolt-on
access
from
the
power
platform.
Therefore,
everything
works
in
the
same
way.
A
The
authentication
works
across
the
board
and
it's
a
lot
easier
to
work
with
our
platform,
but
you
could
be
using
this
video
code
to
create
solutions
around
anywhere,
so
it
doesn't
really
make
any
difference.
But
if
you
are
running
our
code
on
our
platform
on
our
tools,
then
we
make
your
life
a
lot
easier,
whether
you're
a
developer
or
an
id
pro-
and
this
is
all
I
have
to
show
you
in
terms
of
of
slides-
I
have
no
more
slides,
so
let's
jump
straight
into
some
code.
A
So
the
first
thing
I
wanted
to
show
you
is
it's
an
asp.net
solution,
running
with
dot
net
six
and
the
funky
thing
about
this
solution
is
that
it
actually
uses
a
couple
of
things
to
pull
secrets.
Now
I've
worked
with
a
lot
of
customers
out
there
and
a
very
common
theme
that
I
find
is
that
they
they
struggle
to
manage
secrets
in
their
code.
A
Some
of
them
will
be
environmental
variables,
which
is
a
big
no-no.
Some
of
them
will
be
added
directly
into
config
files.
So
I'm
pretty
sure
if
I
were
to
ask
how
many
of
you
have
ever
put
a
secret
in
a
web
config
file
or
or
any
other
config
file,
pretty
pretty
much.
Most
of
you
will
have
done
it
at
some
point
in
their
lifetime.
So
there's
a
there's,
a
consistent
challenge
on
how
do
we
secure
secrets
outside
of
our
code,
while
also
making
it
easy
to
run
on
any
environment?
A
And
we
solve
this
problem
using
the
azure
identity
library
in
in
collaboration
with
the
keyboard,
so
azure
key
vault
can
be
used
to
store
secrets
securely
and
access
secret
securely,
which
is
a
great
solution.
But
there
was
always
this
kind
of
a
catch-22
or
like
a
chicken
and
neck
problem
where
you
put
your
secret
somewhere,
but
now
you
have
to
access
that
service.
A
So
to
take
it
one
step
further,
we
came
up
with
a
notion
of
managed
identities
and
service
principles
and
the
azure
identity
library
has
been
designed
at
its
core
to
actually
do
all
that
for
you.
So
it
uses
an
account
that
you
will
find
somewhere
to
go
and
get
an
access
token
to
access
your
services
and
most
of
the
services
on
azure
these
days
will
support
mana's
identity
out
of
the
box.
A
A
A
This
is
a
great
challenge,
but
let's
assume
that
you
have
some
data
storage
that
is
sitting
on
azure
and
your
code
is
running
on-prem
or
it's
running
on
aws
you,
you
can
now
use
something
like
a
service
principle
or
you
can
use
a
certificate
to
authenticate
against
azure
key
vault
and
still
pull
that
information
across.
So
there
are
ways
to
to
do
that.
We
also
came
up
with
the
notion
of
azure
arc.
So
if
I,
if
I
wanted
to,
I
could
actually
azure
arc
on
board
my
devices.
Let's
say
I
have
a
data
center.
A
That
is
said,
let's
call
it
customer
rackspace.
So
I'm
running
my
infrastructure
on
rackspace
and
I
want
to
be
able
to
access
resources
on
azure.
I
could
azure
arc
in
effect
on
board
those
devices
onto
azure
and
even
though
they're
not
physically
designed
in
our
data
center,
they
look
and
feel
like
azure,
vms
and
therefore
azure
arc
provides
you
with
a
managed
identity.
That
looks
and
feels
like
the
the
the
built-in
managed
identity
on
azure,
but
it's
not
and
because
azurak
now
I
think
that
build.
A
We
announced
an
extension
of
azurarch,
where
you
can
actually
now
run
kubernetes
and
serverless
solutions
on
it.
Like
azure
web
apps.
There
is
work
being
done
to
allow
us
to
bring
the
manus
identity
onto
the
the
pass
solutions
as
well.
Not
just
vms,
so
azure
arc
will
extend
your
network
outside
your
own
azure
data
center
and
bring
it
everywhere.
A
So
we
we
actually
done
a
demo
before
where
we
had
github
actions
using
an
azure
art
joined
device
deploying
to
azure
without
using
anything
other
than
the
mouse
identity,
which
is
great
so
in
this
code
over
here
we
have
two
configuration
settings.
One
is
right:
if
I
go
into
my
app
settings,
it's
very
it's
very
common
to
see
things
like.
Oh,
I
have
some.
You
know
some
secret
here
that
I
need
to
put,
but
as
you'll
notice
this
is
this
is
actually
empty.
A
A
So
here
we
are,
let's
sign
into
my
azure,
let's
jump
straight
into
my
keyboard,
so
there's
a
secret,
zero
problem.
How
do
you
trust
the
app?
Is
it
very
interesting
problem?
The
mazda
identity
solves
exactly
the
secret
zero
problem.
Very
good.
Did
you
already
educate
service
now
to
support
search-based
auth
for
service
principles?
A
I
don't
think
I've
done
that
yet.
So
if
I
want
to
update
all
our
ps1
scripts
on-prem
and
use
azure
key
vault
for
secrets,
do
I
need
to
use
a
and
access
principle
a
service
principle?
Yes,
you're
right,
I
don't
know
if
azure
power
saw
allows
you
to
use
a
service,
it
allows
you
to
use
service
principle.
The
problem
with
the
service
principle
is
that
you
need
to
have
either
a
certificate
or
a
secret
somewhere,
but
yeah.
You
can
do
that
so
here
I
do
have
a
key
vault
somewhere.
Where
is.
A
A
Oh
azure,
automation
that
supports
mazda
denty.
This
is
awesome
yeah.
So
there
was
a
case
where
I
was
saying
in
the
past.
I
put
a
script
out
there
to
allow
you
to
delete
service
principles
periodically,
because
service
principles
are
in
effect,
usernames
and
passwords
littering
staff
around,
especially
if
you're
using
the
client,
credential
authentication.
A
So
what
I
do
is
periodically
delete
them,
which
is
a
good
practice
because
it
will
break
things
like
scripts
and
what
have
you
and
I
have
to
recreate
them,
but
the
whole
point
is
that
you
can
run
it
on
azure
automation
and
I
don't
have
to
worry
about
where.
How
do
I
authenticate
against
azure
active
directory?
So
in
the
seekers
over
here
we
do
have
something
called
some
some
config
value
from
keyboard
which
matches
my
config.
A
If
we
jump
here-
and
the
expectation
is
that,
as
my
program
starts
up,
one
of
the
things
that
asp.net
does
beautifully
is
to
actually
bootstrap
my
config
and
populate
any
values
that
are
here
and
can
be
found
in
key
vault
with
that
value
from
there
now,
because
I'm
running
locally,
I
don't
have
batches
to
manage
identity
unless
I
azure
art
join
my
device.
However,
I
do
have
access
through
my
azure
cli
credentials
and
you
can
use
all
sorts
of
credentials.
You
can
have
a
new
visual
studio,
credential
or
view
code
credential.
A
This
visual
studio
credential
will
be
coming
from
here,
so
I
am
authenticated
already
with
my
microsoft
account
and
therefore
it
will
find
it
will
try
to
find
it
and
do
it
now.
If
you
want
to
be
a
little
bit
more
abstract,
you
could
go
and
say
you
know
what
I
don't
really
care.
Where
that
credential
comes
from,
I
will
use
the
default
azure
credential.
A
This
is
this
is
fine
in
most
cases.
The
reason
why
I
don't
like
doing
that
is
because
I
find
that
it's
it's
two
black
box
right,
because
it
might
find
my
visual
studio
code
credential
or
you
might
find
something
else
and
that
that
connection
may
not
have
access
to
the
resources
I
want.
So
the
way
I
solve
that
problem
is
by
being
super
explicit
and
saying.
This
is
the
order
of
things
that
I
want
to
happen
because
you
can
have
a
you
know:
power
cell
credential.
A
So
this
is
the
one
thing
we're
doing
here
and
once
this
happens,
that
that
credential
is
automatically
available
to
you
that
those
secrets
are
available
to
you
to
call
so
later.
On
one
of
my
pages,
I'm
actually
calling
it
and
then
there
is
another
page.
I
have
my
keyboard
secrets
and
this
is
where
I'm
actually
pulling
the
seeker
from
config
the
first
one,
but
let's
say
that
I
wanted
to
access
something
in
real
time.
Right
runtime.
A
I
want
to
be
able
to
only
pull
that
secret
from
key
vault
when
it's
the
application
is
running
now
this
for
this
one,
I'm
instantiating
a
keyboard,
client
and
then
I'm
pulling
my
other
secrets
from
keyboard
and
they
have
it.
So
this
is
all
running.
We
could
run
it
on
my
local
machine.
I
think
my
other
cli
is
not
signed
in
with
the
right
account.
So
if
I
do
a
z
account,
so
I
think
it
is
yeah
it's
using
my
outlook,
so
I
don't
want
to
use
that
one.
A
A
So
you
don't!
The
azure
act
gives
you
a
mass
identity.
You
don't
always
need
that.
What
about
the
workload
identification
feature
in
preview
could
establish
trust
between
azure
active
directory
and
outside
federation.
Your
apps
are
right.
We
announced
that
aks.
Last
week
there
was
an
announcement
that
aks
can
now
use
a
federated
identity
to
authenticate
against
azure
and
key
vault
to
pull
secrets
out
using
federated
workload
accounts.
A
So
that's
another
way
to
approach
this
now,
which
is
great,
and
I
have
a
demo
later
on
with
a
github
actions
that
shows
you
exactly
how
this
works,
because
that's
that's
probably
the
first
use
case
where
we
moved
away
from
having
to
use
a
service
principal
account
inside
our
github
actions
and
now
using
oauth
to
authenticate,
which
is
great
so
now
I'm
signed
in
I'm
going
around
the
demo.
It's
been
a
while,
since
I
run
this
one,
so
let's
see
what
happens
so
dotnet
run
if
it
doesn't
run
well.
A
I
will
know
that
the
issue
there
is
that
my
account
is
not
provisioned
to
access
keyboard
and
the
easiest
way
to
find
that
is
through
the
access
policies.
And
no,
this
is
not
the
one,
oh
interesting.
Oh,
they
changed
it.
They
changed
the
ui.
Look
at
that
beautiful.
So
this
is
my
account
here,
as
you
have
access
to
everything.
So
the
code
is
running.
In
fact,
if
the
code
was
not
running,
it
would
throw
a
massive
exception
here,
because
it
would
say
I
cannot
access
your
keyboard.
A
So,
let's
because
remember
it
tries
to
load
everything
now
the
config
in
secret
is,
I
am
a
config
secret
and
then,
if
we
jump
to
my
second
year
festive
account
and
that's
from
a
previous
one,
so
what
we
could
do
and
be
funky
about
it
is.
We
can
go
into
our
secrets
and
change
this
one,
and
since
I've
done
quite
a
few
demos,
we
have
lots
of
values
there.
So
we'll
say,
co
immunity
call
and
we
can
save
this
one
or
create
a
new
version.
A
And
now,
if
I
go
back
to
my
page
and
then
refresh
holding
my
breath
there,
you
go
so
the
beauty
about
that
is
that
your
admins
can
change
all
the
secrets
and
you,
as
a
developer,
will
be
totally
oblivious
to
the
fact
that
this
has
happened
and
it
should
work
out
of
the
box.
So
if,
if
you
follow
a
best
practice
and
your
all
your
secrets
are
there
at
the
frequent
cadence,
then
developers
should
not
worry
about
it.
But
I've
shown
you
the
code
running
locally.
What
about
running
in
production.
A
A
I
have
all
the
code
here
on
the
45
show,
but
I
did
send
a
pull
request
yesterday,
which
should
have
been
approved
and
there's
a
net
sample,
finally
enough,
which
we
updated
yesterday,
because
there
were
some
inconsistencies
there
there
and
then
that
sample
was
samples
under
azure.
There's
an
identity,
storage
uses
master
dentist.
So
let
me
put
the
link
over
there.
A
You
can
find
that
sample
to
help
you
out,
there's
a
there's
actually
a
dock
somewhere,
but
for
now
you
can
use
this
one
and
use
mass
identity
to
access
and
the
service
principle
to
access
resources.
So
this
is
this.
Is
one
of
these
examples
there
plenty
of
things,
and
then
we
did
videos
as
well
on
this
and
how
to
use
it
on
the
45.
So
on
our
youtube
channel,
now,
let's
go
back
into
azure
and
see
how
this
is
actually
running
in
production.
A
So
I
do
have
a
website
somewhere
there
you
go,
ignore
the
name:
I've
done
it
for
dot
net
conf
as
well.
So
this
is
a
carryover
demo
that
I
update
all
the
time
at
the
seventh
chance,
the
name
of
the
web,
app
because
you
know
how
painful
that
is
and
having
to
deploy
that,
but
let's,
let's
actually
browse
the
website.
A
So
the
website
is
exactly
the
same
as
the
code.
I
was
running
locally
now.
In
this
instance,
we
are
using
a
manus
identity.
So
if
we
go
here
under
the
identity
component,
we
have
a
system
assigned
identity,
which
means
that
our
managed
identity
is
attached
to
this
resource,
and
this
specific
identity
has
access
to
our
keyboard.
So
if
I
come
out
of
here
and
then
go
back
to
my
key
vault
and
then
we
go
into
our
access
configuration,
no,
that's
not
the
one.
We
want
access
policy.
A
Sorry,
then
you
will
notice
that
we
do
have
a
managed
identity
called
cm.netconf
demo.
That
only
has
two
permissions,
unlike
my
local
account,
which
is
always
a
problem
now
I
am.
The
owner
of
that
subscription.
So
therefore,
usually
have
full
permissions
on
all
resources
and
that's
a
very
dangerous
proposition.
A
We
have
a
get
and
a
list
permission
for
secrets,
only
secrets,
nothing
else
inside
our
for
this
specific
mass
identity.
When
I
usually
do
this
demo,
I
also
set
up
a
service
principle
inside
my
azure
cli
to
use
explicitly
for
this
and
you'll
notice
that
this
is
from
github
action.
So
I
don't
have
one
set
up
right
now,
because
I
deleted
everything:
can
you
do
it
under
the
context
of
the
app
itself
and
not
a
user?
So
in
this
case
the
app
itself
is
accessing
the
the
secrets
for
us,
so
not
the
user.
A
If
I
go
back
to
my
web
app,
this
manage
identity
belongs
to
that
resource.
So
it
doesn't
do
it
on
the
behalf
of
the
user.
It
does
it
as
the
application
itself.
You
could
be
a
little
bit
more
clever
as
well
and
also
assign
a
user
assigned
identity,
which
means
that
now
I
have
full
control
about
how
this
mass
identity
leaves,
because
a
system
assigned
one
will
be
attached
to
the
resource,
whereas
a
user
assigned
one
will
be
assigned
to
or
lubricated
by
me
and
say
it's
a
separate
resource
that
lives
separately.
A
Why?
This
is
important
and
I'm
not
going
to
talk
anymore
about
code
and
we'll
jump
into
some
devops
scenarios.
Why
user
assigned
mass
identities
are
important
is
because
I
could
have
multiple
here
remember.
I
have
a
mass
identity
that
can
access
my
keyboard
and
I
could
have
a
separate
mouse
identity
that
can
access
my
sql
and
then
I
can
also
have
a
separate
mass
identity
that
can
access
my
my
storage
account,
and
that
means
that
I
segregate
my
security.
A
A
I
think
I
have
an
extra
thing.
There
must
be
okay
right
right,
so
we've
seen
how
mass
identity
solves
the
seekers
from
your
code
and
that's
part
of
the
devops.
We
don't
want
secrets
in
the
code
because
they
can
become
an
attack
vector.
A
lot
of
the
attacks
that
have
happened
recently
is
because
people
put
keys
in
key
vault
or
secrets,
or
what
have
you
and
you
know
they
look
into
a
public
github
repo
that
has
happened
to
me
before
funny
story.
A
I
have
my
blog
that
has
access
to
cengrade
to
send
emails
to
new
subscribers
to
my
website
and
I
published
it
to
github
in
a
public
repo
instead
of
a
private
one,
and
that
meant
that
within
an
hour
somebody
used
my
sendgrid
account
to
send
spam
email
and
I
had
an
upper
limit
of
thirty
thousand
emails.
So
I
got
an
email
from
san
gris
saying:
you've
sent
out
30
000
emails.
Congratulations,
I
thought
I
went
viral,
but
that
was
not
the
case.
A
It
was
because
I
put
I
put
that
secret
in
keyboard,
so
we
want
to
definitely
avoid
doing
that
now.
How
do
we
deal
with
with
deployment?
So
we
talked
about
code
and
how
we
avoid
that,
but
how
about
deployments
to
say
production
now,
we'll
start
with
r.
So
many
of
you
have
probably
worked
with
arm
or
bicep,
and
you
know
that
in
arm
we
have
to
define
some
settings.
So
if
I
go
into
my
code
into
my
files,
we
have
an
arm
template
deployment.
A
A
Our
deployment
is
going
to
use
an
account,
so
this
is
also
very
important
when
we
come
here
in
the
service
connections,
you
need
to
say
how
we're
going
to
access
our
resources,
so
we
need
to
authenticate
against
it,
and
in
here
I
created
a
deployment
connection
with
a
specific
service
principle,
and
this
service
principle
also
has
access
to
key
vault
that
key
vault
is
here,
and
that
account
is
this
one.
I
think
it's
the
deployment
access
policies.
I
think
it's
the
first
command
the
cm
key
vault
reader,
which
is
this
is
how
it
maps.
A
A
That
can
be
automatically
sent
to
the
target
applications
which
require
octa
creds.
You
can
extend
the
azure
id
object
with
custom
properties
or
b2c
with
custom
properties.
I'm
not
sure
if
you
want
to
bring
secrets
into
that
token,
but
it
is
possible.
Is
there
an
api
call
to
generate
a
random
secret?
Yes,
there
is
an
api
call
for
key
vault
to
generate
random
secrets.
A
If
you
want
to
before
deploying
the
template,
I
haven't
done
it
with
with
arm
not
sure
you
can
do
that.
One
way
that
you
could
do
that
is,
you
can
do
with
power
cell
and
then
power
cell
will
be
used
to
deploy
the
the
template
for
you
or
you
can
create
a
custom
task
that
you
can
use
inside
your
deployment
script
to
do
so
because
you
can
extend
your
deployment
scripts
or
your
actions
with
what
you
need.
B
A
So
we
talked
about
that
and
therefore,
when
we
run
this
deployment
from
here,
this
pipeline
will
use
the
did.
We
deploy
something:
no,
that's
an
old
one,
recently
around
pipelines.
So
in
here
let
me
actually
yeah,
so
it
doesn't
really
do
anything
magic.
Let
me
see
edit
if
we
come
in
here.
It
just
calls
the
our
deployment
template
and
it
also
uses
an
identity,
and
it
knows
which
connection
to
use
there
you
go.
So
it
needs
to
use
that
connection
so
with
arm.
You
can
do
it
this
way.
A
A
Let's
see
how
you
can
do
it
with
terraform,
so
terraform
also
supports
the
use
of
secrets.
So
there
is
a
key
vault
extension
for
terraform
that
allows
you
to
set
up
your
your
your
keyboard
access
and
then
later
you
can
call
that
to
pull
secrets
out
of
the
keyboard
and
assign
them
to
a
property
which
then
you
can
use
that
property
to
pass
the
information
into
your
deployment,
and
this
is
great
because
it
allows
you
now
to
do
a
lot
of
things
without
having
to
worry
about.
A
B
A
There
you
go
so
let's
keep
bicep
test
and
let's
open
this
in
code
as
well,
thanks
for
joining
us
giovanni.
That
will
also
be
available
for
you
later
on
in
youtube.
I
think
so
there
you
go,
can
devops
service
connection,
use
a
managed
identity
for
doing
armed
deployments,
or
is
this
planned?
I
don't
know
if
azure
devops
supports
mast,
identity,
I
don't
think
it
does.
You
still
have
to
pass
a
service
principle
account
because
it
runs,
I
guess,
on
unless
you're
using
a
custom
agent.
A
So
one
of
the
demos
I
I've
used
in
the
past
was
to
run
the
jobs
in
the
custom
agent
and
therefore
be
able
to
do
that
so
mayo.
Ernesto
says
that
it
does.
I
didn't
know
that
it
does
not
if
you
use
hosted
agents,
so
there
you
go,
let's
see
how
it
works
with
bicep,
so
bisep
added
support
now
for
a
keyboard,
and
what
I
do
have
here
is
a
resource
called
key
keyboard
right
and
then
I
can
use
this
one
to
get
a
secret.
A
This
is
a
recent
addition,
I
think,
maybe
less
than
a
month
ago,
and
the
idea
here
is
that
I
first
instantiate
my
key
vault.
I
use
a
specific
service
principle
to
do
that
again
because
I'm
running
it
locally
and
then
and
then
what
happens?
Is
we
pass
that
information
to
our
file
here
as
as
parameters?
A
So
this
is
a
new
design
and
the
whole
point
is
that
bicep
will
allow
you
to
do
the
same
thing.
Therefore,
you
can
pull
any
seekers
for
any
resources
that
you
need
to
deploy
using
this
approach,
so
we've
done
that
we've
done
terraform
and
all
these
are
available
to
you,
my
they're
all
available
in
my
github
repo.
So
you
can
you
know
in
our
github
repo,
the
45
github
repo,
so
you
can
go
and
have
a
look.
We
also
put
blog
posts
out
there.
A
If
you
want
to
look
at
our
blog,
it's
aka.ms.45,
so
then
blog
and
that
allows
you
to
go
and
see
rather
than
just
looking
at
the
code.
Why
and
how
we
put
everything
together.
There
is
a
palumi
code
as
well
so
cd
that
and
then
cd
plummy
and
I've
done
polluted.
With
aad,
so
let's
open
this
in
code
exactly
the
same
principle
here,
because
again
we
want
to
make
sure
that
your
polumico
doesn't
screw
things
up
and
for
this
pollution
I'm
using.
I
think
I'm
using
what
did
I
use?
I'm
using.net
nice?
A
Oh,
I
have.
Oh,
that's,
not
that's
just
a
random
file.
I
was
like
I
remember.
I
used
typescript,
so
this
balloony
is
using
typescript.
We
do
have
the
azure
extension
here.
As
you
can
see,
the
pattern
is
very
similar.
The
first
thing
that
we
do
is
we
instantiate
a
key
vault,
and
then
we
use
that
information
to
get
a
secret,
which
we
then
pass
as
a
parameter
into
our
files.
A
It
doesn't
have
to
be
sql.
It
can
be
anything
but
the
the
whole
point
there
is
that
you
should
not
be
storing
secrets
and
as
long
as
your
accounts
are
run,
these
deployment
scripts
have
the
right
permissions.
You
should
be
able
to
run
them
from
anywhere
now,
let's
switch
gears
and
let's
go
into
github,
because
github
announced
quite
a
few
things
recently
and
we're
also
working
on
extending
github
actions
to
allow
you
to
do
some
pretty
cool
stuff.
A
So
let
me
find
my
github
somewhere
around
here.
There
you
go.
In
fact
I
was
fixing
things
this
morning
for
my
demos,
so
this
is
the
same
codes
that
we
saw
running
and
we
have
some
deployments
in
there.
If
we
go
to
the
codes
under
github
workflows,
we
have
three
different
solutions.
One
is
the
standard.
A
I
put
a
service
principle
account
into
my
solution
into
my
github
secrets,
and
then
I
authenticate
with
that
and
you
see
we're
using
azure
logging,
the
standardizer
login
and
then
I'm
passing
my
azure
credentials
which
are
stored.
This
is
the
service
principle
account
and
it
runs
so
it
authenticates
without
service
principle.
Remember,
though,
service
principles
are
user
names
and
passwords
stored
somewhere.
A
Therefore,
they
could
be
dangerous
because
whoever
generated
this
account
may
have
access
to
the
secrets
and
they
may
be
able
to
hijack
that
account
to
do
certain
things
like
deleting
and
because
this
service
principle
also
has
contributor
rights.
It
can
do
a
lot
of
damage,
not
just
accessing
secrets.
A
So
if
you
deploy
an
azure
vm
that
already
has
a
mouse
identity
switched
on
then
using
this
extension,
which
we
have
raised
the
pull
request-
and
we
expect
this
pull
request
to
be
approved
at
some
point
in
the
future
to
allow
you
to
work
with
master
dentist,
then,
with
this
extension,
it
means
that
you
don't
have
to
store
anything
inside
github.
There
are
no
service
principles
whatsoever
and
mast
identities.
A
You
know,
keys
and
stuff
are
rolled
automatically
for
you.
So
again
you
don't
have
to
worry
about
that
and
this
this
job.
This
custom
extension
for
now
allows
you
to
use
a
master
denti
and
be
more
efficient
yeah.
This
is
probably
not
the
right
one,
because
I
created
a
separate
branch
for
it
to
use
the
latest
code,
so
this
is
probably
slightly
out
of
date.
I'm
not
going
to
run
this
one
now,
because
the
authentication
flow
changed.
I
will
put
jp.
A
I
know
who's
that
jp
right,
jp
has
abandoned
us,
I'm
just
kidding
now
the
even
more
exciting
bit
on
all
this
is
that
we
now
have
the
ability
to
use
federated
workload
identities
to
authenticate
on
github,
and
that
is
extremely
exciting
because,
as
of
maybe
two
months
ago,
we
added
the
ability
to
authenticate
from
github
actions
into
azure
and
get
a
token
without
having
to
either
use
a
service
principle
or
a
managed
identity.
Therefore,
this
solution
runs
out
of
the
box.
A
Today
you
can
test
it
today,
so
it's
fully
supported
and
it
doesn't
use.
I
mean
it
has
secrets
here,
but
technically
it's
a
client
id
and
a
tenant
id
which
are
not
secret
values
and
would
have
the
subscription
id.
So
it
knows
where
to
go
to
authenticate
and
it
again
gets
an
access
token
to
allow
us
to
do
the
deployment.
A
This
is
even
more
exciting
because,
unlike
mass
identities
or
service
principles,
it
eliminates
the
need
to
add
yet
something
else
that
we
have
to
manage.
And
now
your
iit
admin
team
can
manage
these
accounts.
These
federated
accounts
directly
out
of
the
box.
So
if
I
were
to
run
this
one,
I
obviously
want
to
do
a
little
bit
of
a
change
here
and
let's
go
and
edit
the
startup
file
and
we'll
say
community
call
demo
and
we'll
save
that.
A
And
commit
so
this
is
all
happening
now.
So
if
we
go
back
into
our
actions,
you
should
kick
off
the
process
and
in
the
build
I'm
just
going
to
stop
it
right
after
it
does
the
authentication,
but
this
is
more
or
less
how
we
eliminate
the
need
to
have
secrets
in
our
infrastructures
code
as
well.
I
have
some
issues
with
user
provisioning
services
based
on
ms
azure
is.
Is
it
the?
Can
I
reach?
Oh,
you
can
hear
this
out
for
help.
A
Yeah
cognito
can
help
you
with
aws,
but
it's
slightly
different
to
what
we're
doing
so.
There
you
go.
It's
it's
logged
into
azure
public
service.
Is
there
going
to
be
any
multi-tenant
support
for
azure
arc
agents
in
the
future?
I
don't
know
that
arion
I
could
find
out.
I
know
that
we
are
working
to
bring
something
like
multi-tenancy
support
for
romano's
identities,
and
I
guess
that
once
that
becomes
available,
then
maybe
azure
arc
can
benefit
from
mass
identities,
because
that's
the
dependence
right.
A
If
you
want
to
use
azure
and
manage
identities,
then
mass
identity
needs
to
be
supported
across
multi-tenant
environments.
If
you
do
have,
if
you
do
have
a
specific
use
case,
please
send
me
an
email
425
show
at
microsoft.com,
because
our
engineering
team
is
collecting
feedback
on
how
they
should
be
prioritizing
this
and
what
are
the
use
cases
that
they
need
to
cover.
So
this
is
a
great
great
topic
or
great
use
case
that
I
can
pass
on
to
them.
I
think
we
just
deployed
everything,
and
this
is
exactly
the
code
that
runs
right
here.
A
If
I
go
back
to
my
azure,
it
actually
deployed
the
website,
which
means
that
if
I
come
to
the
website
it
might
take
a
little
bit
of
time
to
start
up,
because
we
just
deployed
it's
thinking
about
it.
Now,
let's
see,
did
we
catch
it
yeah.
You
can
see
it's
starting
up
now,
because
we
just
deployed
and
it
works,
like
you
always
hold
your
breath
like
this
and
then
fingers
crossed
and
those
gross
things
are
going
to
work.
A
A
A
A
But
I
appreciate
everyone
for
joining
us
today.
This
was
definitely
a
lot
of
fun.
What
many
people
don't
know
is
that,
if
you're
accessing
an
azure
resource
from
another
azure
resource,
often
you
don't
need
a
keyboard
at
all.
You
could
add
permissions
that
allow
you
to
demand
them
to
do
so.
That's
that's!
Absolutely
right!
Keyboard
is
only
for
like
it's
needed
for
certain
things
like
storing
secrets,
but
math
identity
does
allow
you
to
access
resources.
That's
the
whole
point
and
again
the
code
does
exactly
that.
A
It
accesses
resources
before
it
accesses
other
resources,
but
your
code
could
access
sql
server
directly
from
your
web
app
without
needing
to
go
through
keyhole.
First,
the
recording
will
be
available,
says
steven,
which
is
great
the
power
platform.
How
can
this
benefit
from
mana
identity?
Well,
the
power
platform.
There
are
two
ways
to
do
that:
I've.
I've
done
it
with
power
apps
before
where
we
authenticated
against
azure
active
directory
using
a
service
principle
account.
A
But
I
don't
know
if
things
like
power
bi,
for
example,
can
you
can
use
that
the
qr
code,
yeah
I'll,
add
the
qr
code
you're
absolute
right
and
I
will
add
a
link
here
to
the
sorry
that
hasn't
changed
there.
You
go
yeah,
so
that's
the
hackathon
url
we
do
have
like.
If
you
attended
this
session
today,
then
there
is
an
awesome
link
that
you
can
use
to
actually
get
your
first
verifiable
credential,
which
is
always
fun
right.
A
A
It's
it's
actually
quite
mesmerizing
to
see
how
how
well
it
works
and
how
you
can
eliminate
the
the
need
of
managing
credentials,
because
now,
as
an
enterprise,
you
can
use
verifiable
credentials
to
authenticate
people
without
you
having
to
manage
them,
which
is
great
so
this,
if
I
add
it
to
the
link,
if
I
add
a
link
here,
do
keep
in
mind
that
you
don't
need,
provide
excessive
permissions
to
apps
yeah,
that's
something
that
we
didn't
cover.
I
think
I
touched
upon
it
very
very
shortly.
It
is
very
important
to
always
provision
for
the
right
things.
A
So
if
you
are,
if
you
do
need
to
access
data
inside
your
storage,
account
and
you're,
not
editing
anything,
you
should
be
a
reader,
not
a
contributor
to
that
storage
account,
whichever
account
you
use
so
here
in
my
key
vault,
let's
jump
in
there
very
quickly.
Just
show
you
stuff
in
the
access
policies.
A
The
accounts
that
I
use
for
for
accessing
the
secrets
from
the
different
agents
and
tasks
only
have
a
get
and
a
list
permission
in
our
keyboard
and
if
you
switch
to
azure
active
directory
authentication
because
right
now
we're
using
access
policies
instead
of
our
back
with
our
back
now,
you
can
provide
a
fine-tuned
access
permission
at
the
secret
level,
so
you
might
want
to
say.
I
only
want
this
account
to
access
specific
secrets
and
read
them
rather
than
giving
them
access
to
the
whole
keyboard.
A
Because
if
I
do
an
enumeration
of
all
the
secrets,
then
that
also
presents
a
challenge,
because
I
may
have
secrets
for
other
applications.
I
may
have
connection
strings
to
other
databases
that
my
application
doesn't
need
to
use.
So
you
could
have
an
enumeration
attack
because
somebody
has
found
a
way
to
to
hijack
the
code
and
dump
them
somewhere
else
didn't
see
an
answer.
This
does
mass
identity
work
in
power,
automate
flows.
I
haven't
tested
that.
So
that's
a
question
I
can.
We
can
take
back
and
ask
the
recommendation
is
to
use
azure
our.
B
A
For
keyboard,
that's
absolutely
right.
I
would
say
yes
now
that
we
support
them
and
we
have
a
more
fine-tuned
access
to
secrets.
Yes
use
our
back
over
access
policies.
This
is
a
slightly
older
demo,
which
I
need
to
update
at
some
point
as
well,
but
it
just
shows
that
you
can
do
both,
and
it
is
very
important
to
know
that
once
you
switch
your
key
vault
to
use
our
back,
then
it
uses
just
starbucks
you
can.
You
can
use
a
mix
of
both
access
policies
and
our
back
for
configuration.
A
So
you
can
see
here
they
they've.
Definitely
they
combined.
They
used
to
combine
access
policies
and
access
configuration
in
one,
and
now
you
can
see
that
they've
changed
that,
and
so
this
is
a
vault
access
policy.
You
can
change
to
our
back
and
you
also
notice
that,
because
I
wanted
to
use
key
vault
for
provisioning
resources,
I
had
to
check
this
box.
Otherwise
it
will
not
work.
You
can
use
key
vault
with
service
principles
or
mass
identities
to
deploy
stuff
yeah
there.
A
You
have
it
we'll,
sir
I'll
share
the
slide
deck
as
well
later
on,
but
make
sure
to
get
your
buds
get.
Your
verifiable
credential
today
sign
up
for
a
hackathon
and
then
make
sure
to
follow
us
on
youtube
or
twitch.
If
you
want
to
stay
up
to
date
with
things
like
that,
how
do
you
do
end-to-end
security
things
with
master
denti,
any
language
any
platform?
So
today
I
did
show
you
how
to
deal
with
net,
but
I
also
have
a
very
similar
demo
with
node,
if
I
remember
correctly
from
cd.
A
So
I
remember,
I
have
the
the
node
stuff,
so
cd
node
node
api,
secure,
node,
maybe
secure
node.
There
you
go
and
then
I
will
open
this
very
briefly
again.
This
is
also
available
on
on
our
repos.
So
in
here
what
we
do
is
we
and
the
code
is
very
similar
as
well.
So
node
is
awesome
because
azure
identity
has
done
that
very,
very
well,
consistent
way
to
create
credentials
and
then
pass
them
to
services.
A
So
here
I'm
working
with
cosmos
and
I
have
a
credential
which
I
than
used
to
authenticate
and
we
also
get
a
secret
from
keyboard
as
one
of
the
tasks
there.
That
code
is
ready
to
download
and
run.
Can
you
explain
a
bit
about
what
goes
on
in
the
hackathon?
I
can
explain
that
absolutely
so.
For
the
hackathon.
We
expect
people
to
build
a
solution
that
can
issue
and
verify
credential
or
just
verify
credentials.
A
We
have
the
samples
and
everything
is
free,
so
you
can
get
a
free
out
subscription.
You
can
get
a
free,
azure
id
tenant
through
the
microsoft
365
developer
program.
So
you
don't
need
to.
You
know,
bring
resources.
You
can
get
brand
new
ones
for
the
hackathon
itself
and
then
we
have
samples
in
multiple
languages
like
dotnet,
java,
javascript
and
python,
that
you
can
use
as
the
basis
for
you
to
build
something
and
to
qualify.
A
All
you
have
to
do
is
just
do
a
very
quick,
two
minute,
video
presentation
that
says
this
is
how
I
build
it.
This
is
why
I
built
it.
These
are
the
scenarios
I
think
that
they
work
for
this,
like
we
want
to
enroll
every
student
in
the
university
and
get
them
a
verifiable
credential
that
they
can
present
at
the
cafeteria
to
to
get
access
to
their
their
funds
and
pay
for
food.
A
Whatever
scenario
you
want
to
think
right,
but
we're
giving
you
most
of
the
the
things
that
you
need
to
participate
in
the
hackathon
for
free.
You
just
need
to
customize
it
and
build
it
for
yourself
and
off
you
go
also.
We
do
have
a
fantastic
blog
that
summarizes
all
the
activities
that
we're
doing
this
month.
A
A
Let
me
know
in
the
comments
hit
me
on
twitter,
if
you
have
any
questions
about
mt
and
make
sure
to
join
our
discord
community,
because-
and
this
is
where
all
the
goodness
is
happening.
Thank
you
very
much
for
the
kind
comments
everyone.
I
hope
you
all
have
a
great
day
and
join
the
next
community
call
on
the
17th.