> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# Managed Identity abuse (Azure)

> VM/Function/App Service con Managed Identity (MI) puede pedir token al endpoint http://169.254.169.254/metadata/identity/oauth2/token con header Metadat…

# Managed Identity abuse (Azure)

<p className="glossary-answer">VM/Function/App Service con Managed Identity (MI) puede pedir token al endpoint [http://169.254.169.254/metadata/identity/oauth2/token](http://169.254.169.254/metadata/identity/oauth2/token) con header Metadata: true.</p>

**Categoría:** [Cloud (AWS · Azure · GCP)](/glosario)

🎯 **Trinchera** — VM/Function/App Service con Managed Identity
(MI) puede pedir token al endpoint
`http://169.254.169.254/metadata/identity/oauth2/token` con header
`Metadata: true`. Sin secret hardcoded — pero si la MI tiene
`Contributor` sobre la subscription, lateral total.

🔗 **Kill chain** — Comprometes la VM → request al IMDS →
token Graph/ARM → enumerar y escalar.

📡 **Huella defensiva** — Token requests anómalos desde recursos
no-admin; audit log Entra; Defender for Cloud alertas.

⚠️ **Falso amigo** — System-assigned MI tiene endpoint distinto
(169.254.169.254) que User-assigned (variable `IDENTITY_ENDPOINT`).

🛡️ **Remediación** — Principle of Least Privilege en MIs;
nunca asignar Contributor cuando basta `Reader` + role custom.

```bash theme={null}
curl "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net" \
  -H "Metadata: true"
```

***

← [Volver al glosario completo](/glosario)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"Managed Identity abuse (Azure)","description":"VM/Function/App Service con Managed Identity (MI) puede pedir token al endpoint http://169.254.169.254/metadata/identity/oauth2/token con header Metadata: true.","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Glosario táctico de pentesting","url":"https://rootea.es/glosario"},"url":"https://rootea.es/glosario/managed-identity-abuse-azure"}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Inicio","item":"https://rootea.es"},{"@type":"ListItem","position":2,"name":"Glosario táctico","item":"https://rootea.es/glosario"},{"@type":"ListItem","position":3,"name":"Managed Identity abuse (Azure)","item":"https://rootea.es/glosario/managed-identity-abuse-azure"}]}`}
</script>

*Última actualización: 2026-06-11*