--- cuppy_hub: azure cuppy_path: reference/overview/services-and-identities.md cuppy_section: docs cuppy_doc: CHHH-9A4Q cuppy_doc_uuid: 06fd17c4-e9b2-4cb2-94f0-f39308102121 cuppy_permalink: https://cuppy.io/azure/d/CHHH-9A4Q cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/overview/services-and-identities cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 6ae0b0e6547f1ece03e547443ea06e3e62c4596c21a9bb152ca3001463a3ff6a # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Azure hub map — services covered and which identity to use ## Which identity should make the call Decide this first: most Azure failures trace back to the wrong identity, and the right one removes the secret entirely. | Code runs… | Use | Why | Guide | |---|---|---|---| | On an Azure resource (App Service, Functions, Container Apps, VM, AKS) | **Managed identity** (user-assigned when shared or recreated by IaC) | No secret; Azure rotates it | `guides/managed-identity/use-managed-identity.md` | | In GitHub Actions, Azure Pipelines, GitLab, Terraform Cloud, another cloud, Kubernetes outside Azure | **Workload identity federation** on a user-assigned identity or an app | Exchanges the platform's own token; no secret | `guides/entra/github-actions-oidc.md` | | Somewhere with no federation option | **Service principal with a certificate** | Microsoft recommends a trusted certificate over a secret | `guides/entra/create-service-principal.md` | | Same, when a certificate is impossible | Service principal with a **secret** (expires; `az ad sp create-for-rbac` sets one year) | Last resort; rotate before `AADSTS7000222` | `reference/entra/errors.md` | | On a developer's machine | The developer's own sign-in (`az login`, through `DefaultAzureCredential`) | Same code path as production | `reference/azure-identity/credential-chain.md` | | Unattended, as a user (username and password) | **Don't** | MFA and conditional access break it | `reference/entra/sign-in-errors.md` | ## What each family covers | Family | Services | Start with | |---|---|---| | 1. Identity and access | Microsoft Entra ID (apps, service principals, tokens, AADSTS), managed identities, workload identity federation, `@azure/identity`, Azure RBAC, Azure Policy, Key Vault access | `guides/identity/fix-access-denied.md` | | 2. Resource Manager and IaC | Resource IDs, providers, API versions, throttling, locks and tags, Bicep, ARM deployments and stacks, `azd`, Terraform as the alternative | `guides/bicep/deploy-bicep.md`, `guides/arm/debug-failed-deployment.md` | | 3. Storage | Storage accounts, Blob and its data protection, ADLS Gen2, Files (SMB and NFS), Tables, SAS, network access | `reference/storage/access-errors.md`, `guides/storage/access-blobs-from-typescript.md` | | 4. Compute | Functions (with Durable and on Container Apps), App Service and ASE v3, Container Apps, Container Registry, Container Instances, VMs, scale sets and Compute Gallery | `reference/functions/errors.md`, `reference/app-service/errors.md`, `reference/container-apps/errors.md`, `reference/vm/errors.md` | | 5. Networking | VNets, subnets, peering, NSGs, routes, NAT gateway, private endpoints and DNS, Load Balancer, Application Gateway and WAF, Front Door, VPN Gateway, ExpressRoute, Firewall, DDoS, Bastion, Virtual WAN, Virtual Network Manager | `guides/networking/diagnose-connectivity.md`, `reference/networking/errors.md` | | 6. Databases | Azure SQL Database and Managed Instance, Cosmos DB (NoSQL, MongoDB, Table) and Azure DocumentDB, PostgreSQL and MySQL flexible server, Azure Managed Redis, retired database services | `patterns/app-to-database-with-managed-identity.md`, `reference/sql/errors.md`, `reference/cosmos-db/errors.md` | | 7. Observability | Azure Monitor: Log Analytics workspaces, Application Insights with OpenTelemetry, diagnostic settings, data collection rules and Azure Monitor Agent, the Logs Ingestion API, alerts and action groups | `reference/monitor/what-to-use.md`, `guides/monitor/instrument-node-app-with-opentelemetry.md`, `reference/monitor/application-insights-errors.md`, `reference/monitor/alerts.md` | | 8. Messaging and integration | Service Bus, Event Grid, Event Hubs, Storage queues, API Management, Logic Apps | *planned* | | 9. Azure OpenAI in Foundry Models | Deployments, quotas, keyless auth, content filter errors | *planned* | | 10. Cost and limits | Reading quotas, usage and SKU availability live | *planned* | **Identity and access documents:** - Error catalogues: `reference/entra/errors.md`, `reference/entra/sign-in-errors.md`, `reference/entra/federated-credential-errors.md`, `reference/azure-identity/errors.md`, `reference/managed-identity/errors.md`, `reference/rbac/errors.md`, `reference/policy/effects-and-errors.md`, `reference/keyvault/access-and-errors.md`. - Models: `reference/rbac/role-assignments-and-scopes.md`, `reference/azure-identity/credential-chain.md`, `reference/entra/workload-and-agent-identities.md` (Conditional Access for service principals, Entra Agent ID). - Guides: `guides/rbac/assign-roles.md`, `guides/entra/create-service-principal.md`, `guides/entra/github-actions-oidc.md`, `guides/managed-identity/use-managed-identity.md`. - Handoffs: `patterns/github-actions-to-azure.md`, `patterns/app-to-keyvault-with-managed-identity.md`. **Resource Manager and IaC documents:** error catalogues `reference/arm/errors.md`, `reference/arm/deployment-errors.md`, `reference/bicep/compile-errors.md`, `reference/azd/errors.md`; references `reference/arm/resource-ids-and-providers.md`, `reference/arm/throttling-and-long-running-operations.md`, `reference/arm/locks-and-tags.md`, `reference/arm/deployment-stacks.md`; patterns `patterns/bicep-idempotent-redeploy.md`, `patterns/alternatives/terraform-azurerm.md`. **Storage documents:** error catalogues `reference/storage/access-errors.md`, `reference/storage/sas-and-key-errors.md`, `reference/storage/data-errors.md`, `reference/storage/files-access-and-errors.md`, `reference/storage/tables.md`; references `reference/storage/access-models.md`, `reference/storage/sas.md`, `reference/storage/network-and-firewall.md`, `reference/storage/accounts-and-redundancy.md`, `reference/storage/adls-gen2.md`, `reference/storage/blob-data-protection.md`; guides `guides/storage/access-blobs-from-typescript.md`, `guides/storage/create-secure-storage-account.md`; pattern `patterns/app-to-storage-with-managed-identity.md`. **Compute documents:** error catalogues `reference/functions/errors.md`, `reference/app-service/errors.md`, `reference/container-apps/errors.md`, `reference/container-registry/errors.md`, `reference/container-instances/errors.md`, `reference/vm/errors.md`, `reference/functions/durable-functions.md`, `reference/app-service/app-service-environment.md`; references `reference/functions/hosting-and-host-storage.md`, `reference/functions/functions-on-container-apps.md`, `reference/app-service/configuration-and-networking.md`, `reference/container-apps/apps-ingress-and-scale.md`, `reference/vm/scale-sets-and-images.md`; guides `guides/functions/deploy-typescript-function.md`, `guides/app-service/deploy-node-app.md`; patterns `patterns/github-actions-to-container-apps.md`, `patterns/functions-keyless-host-storage.md`. **Networking documents:** references `reference/networking/vnets-subnets-and-peering.md`, `reference/networking/outbound-connectivity.md`, `reference/networking/nsgs-and-routes.md`, `reference/networking/private-endpoints-and-dns.md`, `reference/networking/virtual-wan-and-network-manager.md`; error catalogues `reference/networking/errors.md`, `reference/networking/vpn-and-expressroute.md`, `reference/networking/firewall-and-ddos.md`, `reference/networking/bastion.md`, `reference/application-gateway/errors.md`, `reference/front-door/errors.md`, `reference/load-balancer/errors.md`; guide `guides/networking/diagnose-connectivity.md`; pattern `patterns/private-endpoint-for-paas.md`. **Databases documents:** error catalogues `reference/sql/errors.md`, `reference/cosmos-db/errors.md`, `reference/postgresql/flexible-server.md`; references `reference/sql/connections-and-auth.md`, `reference/sql/managed-instance.md`, `reference/sql/scale-and-continuity.md`, `reference/cosmos-db/access-and-modeling.md`, `reference/cosmos-db/other-apis-and-documentdb.md`, `reference/postgresql/replicas-upgrades-and-clusters.md`, `reference/mysql/flexible-server.md`, `reference/redis/managed-redis.md`, `reference/databases/retired-and-replacements.md`; guide `guides/sql/connect-from-typescript.md`; pattern `patterns/app-to-database-with-managed-identity.md`. **Observability documents:** start with `reference/monitor/what-to-use.md` (current building blocks and retirements); guide `guides/monitor/instrument-node-app-with-opentelemetry.md`; error catalogues `reference/monitor/application-insights-errors.md`, `reference/monitor/alerts.md`; references `reference/monitor/log-analytics-workspaces.md`, `reference/monitor/diagnostic-settings-and-data-collection.md`. ## Child hubs These services have their own hubs, which inherit this one. Anything about Entra ID, RBAC, networking, Key Vault, storage accounts or Azure Monitor stays here, even when a child-hub task needs it. | Child hub | Covers | |---|---| | Fabric (with Power BI) | Capacities, workspaces, OneLake, Lakehouse, Warehouse, Data Factory in Fabric, Real-Time Intelligence, semantic models, Power BI REST | | AKS | Clusters, node pools, cluster networking, workload identity in the cluster, upgrades | | Databricks | Azure Databricks workspaces, Unity Catalog, compute, jobs | | Synapse | Synapse Analytics, Azure Data Factory, and the path to Fabric | ## Outside this hub Microsoft's own Learn MCP server (`https://learn.microsoft.com/api/mcp`) searches and fetches the official documentation and code samples. Use it for reference text this hub doesn't hold. This hub holds the synthesis: ranked causes with a check for each, the role and cost of a call, and handoffs between services. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.