Azure hub map — services covered and which identity to use
The map of this hub — which Azure services each family covers, where each one's guides, error catalogues and patterns are, which services live in the child hubs (Fabric with Power BI, AKS, Databricks, Synapse) — and the decision every Azure task starts with, which kind of identity should make the call (managed identity, workload identity federation, certificate or secret service principal, user).
markdownreferencev1CHHH-9A4Qstage: referencetrust: officialservice: overviewinterface: anyAzure hub mapservices coveredchild hubs Fabric AKS Databricks Synapsewhich identity to use Azuremanaged identity vs service principalworkload identity federation vs client secretcertificate vs secretuser credentials automationMicrosoft Learn MCP server
Which identity should make the call
Decide this first: most Azure failures trace back to the wrong identity, and the right one removes the secret entirely.
| Code runs… | Use | Why | Guide |
|---|---|---|---|
| On an Azure resource (App Service, Functions, Container Apps, VM, AKS) | Managed identity (user-assigned when shared or recreated by IaC) | No secret; Azure rotates it | guides/managed-identity/use-managed-identity.md |
| In GitHub Actions, Azure Pipelines, GitLab, Terraform Cloud, another cloud, Kubernetes outside Azure | Workload identity federation on a user-assigned identity or an app | Exchanges the platform's own token; no secret | guides/entra/github-actions-oidc.md |
| Somewhere with no federation option | Service principal with a certificate | Microsoft recommends a trusted certificate over a secret | guides/entra/create-service-principal.md |
| Same, when a certificate is impossible | Service principal with a secret (expires; az ad sp create-for-rbac sets one year) | Last resort; rotate before AADSTS7000222 | reference/entra/errors.md |
| On a developer's machine | The developer's own sign-in (az login, through DefaultAzureCredential) | Same code path as production | reference/azure-identity/credential-chain.md |
| Unattended, as a user (username and password) | Don't | MFA and conditional access break it | reference/entra/sign-in-errors.md |
What each family covers
| Family | Services | Start with |
|---|---|---|
| 1. Identity and access | Microsoft Entra ID (apps, service principals, tokens, AADSTS), managed identities, workload identity federation, @azure/identity, Azure RBAC, Azure Policy, Key Vault access | guides/identity/fix-access-denied.md |
| 2. Resource Manager and IaC | Resource IDs, providers, API versions, throttling, locks and tags, Bicep, ARM deployments and stacks, azd, Terraform as the alternative | guides/bicep/deploy-bicep.md, guides/arm/debug-failed-deployment.md |
| 3. Storage | Storage accounts, Blob and its data protection, ADLS Gen2, Files (SMB and NFS), Tables, SAS, network access | reference/storage/access-errors.md, guides/storage/access-blobs-from-typescript.md |
| 4. Compute | Functions (with Durable and on Container Apps), App Service and ASE v3, Container Apps, Container Registry, Container Instances, VMs, scale sets and Compute Gallery | reference/functions/errors.md, reference/app-service/errors.md, reference/container-apps/errors.md, reference/vm/errors.md |
| 5. Networking | VNets, subnets, peering, NSGs, routes, NAT gateway, private endpoints and DNS, Load Balancer, Application Gateway and WAF, Front Door, VPN Gateway, ExpressRoute, Firewall, DDoS, Bastion, Virtual WAN, Virtual Network Manager | guides/networking/diagnose-connectivity.md, reference/networking/errors.md |
| 6. Databases | Azure SQL Database and Managed Instance, Cosmos DB (NoSQL, MongoDB, Table) and Azure DocumentDB, PostgreSQL and MySQL flexible server, Azure Managed Redis, retired database services | patterns/app-to-database-with-managed-identity.md, reference/sql/errors.md, reference/cosmos-db/errors.md |
| 7. Observability | Azure Monitor: Log Analytics workspaces, Application Insights with OpenTelemetry, diagnostic settings, data collection rules and Azure Monitor Agent, the Logs Ingestion API, alerts and action groups | reference/monitor/what-to-use.md, guides/monitor/instrument-node-app-with-opentelemetry.md, reference/monitor/application-insights-errors.md, reference/monitor/alerts.md |
| 8. Messaging and integration | Service Bus, Event Grid, Event Hubs, Storage queues, API Management, Logic Apps | planned |
| 9. Azure OpenAI in Foundry Models | Deployments, quotas, keyless auth, content filter errors | planned |
| 10. Cost and limits | Reading quotas, usage and SKU availability live | planned |
Identity and access documents:
- Error catalogues:
reference/entra/errors.md,reference/entra/sign-in-errors.md,reference/entra/federated-credential-errors.md,reference/azure-identity/errors.md,reference/managed-identity/errors.md,reference/rbac/errors.md,reference/policy/effects-and-errors.md,reference/keyvault/access-and-errors.md. - Models:
reference/rbac/role-assignments-and-scopes.md,reference/azure-identity/credential-chain.md,reference/entra/workload-and-agent-identities.md(Conditional Access for service principals, Entra Agent ID). - Guides:
guides/rbac/assign-roles.md,guides/entra/create-service-principal.md,guides/entra/github-actions-oidc.md,guides/managed-identity/use-managed-identity.md. - Handoffs:
patterns/github-actions-to-azure.md,patterns/app-to-keyvault-with-managed-identity.md.
Resource Manager and IaC documents: error catalogues reference/arm/errors.md, reference/arm/deployment-errors.md, reference/bicep/compile-errors.md, reference/azd/errors.md; references reference/arm/resource-ids-and-providers.md, reference/arm/throttling-and-long-running-operations.md, reference/arm/locks-and-tags.md, reference/arm/deployment-stacks.md; patterns patterns/bicep-idempotent-redeploy.md, patterns/alternatives/terraform-azurerm.md.
Storage documents: error catalogues reference/storage/access-errors.md, reference/storage/sas-and-key-errors.md, reference/storage/data-errors.md, reference/storage/files-access-and-errors.md, reference/storage/tables.md; references reference/storage/access-models.md, reference/storage/sas.md, reference/storage/network-and-firewall.md, reference/storage/accounts-and-redundancy.md, reference/storage/adls-gen2.md, reference/storage/blob-data-protection.md; guides guides/storage/access-blobs-from-typescript.md, guides/storage/create-secure-storage-account.md; pattern patterns/app-to-storage-with-managed-identity.md.
Compute documents: error catalogues reference/functions/errors.md, reference/app-service/errors.md, reference/container-apps/errors.md, reference/container-registry/errors.md, reference/container-instances/errors.md, reference/vm/errors.md, reference/functions/durable-functions.md, reference/app-service/app-service-environment.md; references reference/functions/hosting-and-host-storage.md, reference/functions/functions-on-container-apps.md, reference/app-service/configuration-and-networking.md, reference/container-apps/apps-ingress-and-scale.md, reference/vm/scale-sets-and-images.md; guides guides/functions/deploy-typescript-function.md, guides/app-service/deploy-node-app.md; patterns patterns/github-actions-to-container-apps.md, patterns/functions-keyless-host-storage.md.
Networking documents: references reference/networking/vnets-subnets-and-peering.md, reference/networking/outbound-connectivity.md, reference/networking/nsgs-and-routes.md, reference/networking/private-endpoints-and-dns.md, reference/networking/virtual-wan-and-network-manager.md; error catalogues reference/networking/errors.md, reference/networking/vpn-and-expressroute.md, reference/networking/firewall-and-ddos.md, reference/networking/bastion.md, reference/application-gateway/errors.md, reference/front-door/errors.md, reference/load-balancer/errors.md; guide guides/networking/diagnose-connectivity.md; pattern patterns/private-endpoint-for-paas.md.
Databases documents: error catalogues reference/sql/errors.md, reference/cosmos-db/errors.md, reference/postgresql/flexible-server.md; references reference/sql/connections-and-auth.md, reference/sql/managed-instance.md, reference/sql/scale-and-continuity.md, reference/cosmos-db/access-and-modeling.md, reference/cosmos-db/other-apis-and-documentdb.md, reference/postgresql/replicas-upgrades-and-clusters.md, reference/mysql/flexible-server.md, reference/redis/managed-redis.md, reference/databases/retired-and-replacements.md; guide guides/sql/connect-from-typescript.md; pattern patterns/app-to-database-with-managed-identity.md.
Observability documents: start with reference/monitor/what-to-use.md (current building blocks and retirements); guide guides/monitor/instrument-node-app-with-opentelemetry.md; error catalogues reference/monitor/application-insights-errors.md, reference/monitor/alerts.md; references reference/monitor/log-analytics-workspaces.md, reference/monitor/diagnostic-settings-and-data-collection.md.
Child hubs
These services have their own hubs, which inherit this one. Anything about Entra ID, RBAC, networking, Key Vault, storage accounts or Azure Monitor stays here, even when a child-hub task needs it.
| Child hub | Covers |
|---|---|
| Fabric (with Power BI) | Capacities, workspaces, OneLake, Lakehouse, Warehouse, Data Factory in Fabric, Real-Time Intelligence, semantic models, Power BI REST |
| AKS | Clusters, node pools, cluster networking, workload identity in the cluster, upgrades |
| Databricks | Azure Databricks workspaces, Unity Catalog, compute, jobs |
| Synapse | Synapse Analytics, Azure Data Factory, and the path to Fabric |
Outside this hub
Microsoft's own Learn MCP server (https://learn.microsoft.com/api/mcp) searches and fetches the official documentation and code samples. Use it for reference text this hub doesn't hold. This hub holds the synthesis: ranked causes with a check for each, the role and cost of a call, and handoffs between services.