An Entra ID identity automatically provisioned for an Azure resource such as a VM, function app or automation account, letting it obtain tokens for other services without any stored credential. System-assigned identities live and die with the resource; user-assigned identities are standalone objects shareable across resources. They eliminate secrets and certificates from code for Azure-hosted workloads.