azure-managedidentity-imds-access-token
A process with guest access can request a managed-identity bearer token from IMDS. No single Azure RBAC action authorizes this service-native path; its own authentication and authorization apply.
Where it sits
| location | IMDS /metadata/identity/oauth2/token response.access_token |
|---|
| location kind | output_value |
|---|
| data kinds | credential oauth_token bearer_token |
|---|
| emits edge | ExposesCredential |
|---|
| service | Managed Identities (azure:managedidentity) |
|---|
Collection recipe
| access mode | data_plane |
|---|
| operation | GET http://169.254.169.254/metadata/identity/oauth2/token |
|---|
| response path | access_token |
|---|
| encoding | json |
|---|
| params | {"Metadata": "true", "api-version": "2018-02-01", "resource": "\u003caudience\u003e"} |
|---|
References