Cloud Renames Contribute
RenamedCompute, Security & InfraAzure

Azure AD Workload Identity Microsoft Entra Workload ID

Legacy names Azure AD Workload Identity, Azure AD Pod Identity

Identity, OIDC federation, and lifecycle governance solution for software workloads, Kubernetes pods, GitHub Actions, and service principals accessing cloud resources without secrets.

Open in interactive timeline ↗All Azure renamesHome

Naming timeline

  1. Azure AD Pod Identity

    · Open-Source Launch (Deprecated Oct 2022)

    Introduced pod-managed identities on AKS using NMI/MIC daemonsets intercepting IMDS requests; officially deprecated in October 2022.

  2. Azure AD Workload Identity

    · OIDC Federation General Availability

    Replaced AAD Pod Identity using native Kubernetes Service Account Token Volume Projection and OpenID Connect (OIDC) federated identity credentials.

  3. Microsoft Entra Workload IDCurrent name

    · Microsoft Entra Rebrand & Product Expansion

    Renamed to Microsoft Entra Workload ID, uniting OIDC workload identity federation with identity protection and Conditional Access for applications and service principals.

What is Azure AD Workload Identity called now?

Azure AD Workload Identity is now called Microsoft Entra Workload ID, with the latest change in November 2023 (Microsoft Entra Rebrand & Product Expansion). Earlier names covered by this entry also include Azure AD Pod Identity. Identity, OIDC federation, and lifecycle governance solution for software workloads, Kubernetes pods, GitHub Actions, and service principals accessing cloud resources without secrets. Only the customer-facing name changed; the underlying technical identifiers remain backward compatible.

Also known as

  • AAD Pod Identity
  • Workload Identity Federation
  • AKS Workload Identity

Technical identifiers

Technical identifiers unchanged. Only the customer-facing product name changed; the APIs, CLI commands, IAM roles and Terraform resources below keep their legacy identifiers for backward compatibility.

ARM Resource Providers (Microsoft.*)Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials graph.microsoft.com (applications/federatedIdentityCredentials)
Azure CLI (az) / PowerShellaz identity federated-credential az aks create --enable-oidc-issuer --enable-workload-identity az ad app federated-credential
Entra ID / Azure RBAC RolesManaged Identity Operator Managed Identity Contributor Application Administrator
Terraform Resources (azurerm_*)azurerm_federated_identity_credential azuread_application_federated_identity_credential azurerm_user_assigned_identity

OIDC federated credential APIs (Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials), az identity federated-credential, and Terraform resources remain active; only the legacy IMDS-based AAD Pod Identity v1 add-on was deprecated.

Notes & disambiguation

  • Evolved from the open-source Azure AD Pod Identity project for Kubernetes (which intercepted Instance Metadata Service traffic and was deprecated in October 2022) to OIDC-based Azure AD Workload Identity (GA March 2023 on AKS), before being rebranded to Microsoft Entra Workload ID in late 2023.
  • Microsoft Entra Workload ID encompasses both OIDC workload identity federation (enabling AKS pods, GitHub Actions, and external compute to exchange tokens with user-assigned managed identities or app registrations without secrets) and premium workload identity governance and conditional access.
  • ARM federated credential resources (Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials), Azure CLI commands (az identity federated-credential), and Terraform resources (azurerm_federated_identity_credential and azuread_application_federated_identity_credential) remain unchanged.

Sources & official documentation

Catalog last updated . Spotted an error? Suggest an edit