title: Use Azure Managed Identities for service to service calls
body: <p>Right now I'm using AAD app to make Service A => Service B calls. This includes:</p>
  
  <ol>
  <li>AAD app</li>
  <li>KeyVault which keeps a secret/certificate for AAD app</li>
  <li>Managed Identity with access to KeyVault</li>
  </ol>
  
  <p>The flow looks like this:</p>
  
  <ol>
  <li>Service A: Get token from Managed Identity</li>
  <li>Service A: Go to KeyVault, present a token and get a secret for AAD app</li>
  <li>Service A: Go to AAD, present a secret and request a token for a particular resource</li>
  <li>Service A: Make a call to Service B</li>
  <li>Service B: Validate a token and a resource</li>
  </ol>
  
  <p>I wonder whether it is possible to register a managed identity with my service, so if a Managed Identity token is presented then Service B can trust Service A. Something like this:</p>
  
  <ol>
  <li>Service A: Get token from Managed Identity</li>
  <li>Service A: Make a call to Service B</li>
  <li>Service B: Validate that token comes from registered Managed Identity</li>
  </ol>
  
  <p>Is it feasible? Does it violate any security best practices?</p>
  
  <p><strong>Update:</strong> beside below answer, the following stack overflow post describes how to make Managed Identity in one tenant to get a role claim for an app in another tenant</p>
  
  <p><a href="https://stackoverflow.com/questions/52646321/grant-service-principal-access-to-application-in-other-tenant">Grant service principal access to application in other tenant</a></p>