From magic-powers
Use when configuring Microsoft Entra ID (Azure AD), managing app registrations, setting up Conditional Access policies, implementing PIM for privileged access, or studying for AZ-500, SC-500, or AZ-305.
npx claudepluginhub kienbui1995/magic-powers --plugin magic-powersThis skill uses the workspace's default tool permissions.
- Designing identity architecture for Azure solutions
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
| Identity | Description | Use Case |
|---|---|---|
| User | Human identity with credentials | Employee sign-in |
| Group | Collection of users/service principals | RBAC assignment at scale |
| Service Principal | App identity in a tenant; auto-created with App Registration | Application-to-Azure auth |
| System-assigned Managed Identity | Identity tied to Azure resource lifecycle | VM, Function App, AKS accessing other Azure services |
| User-assigned Managed Identity | Standalone identity; reusable across resources | Shared identity for multiple resources |
| B2B Guest | External user federated with their own IdP | Partner/vendor access |
| B2C Customer | Consumer identity (social, custom) via Entra B2C | Customer-facing apps |
| Concept | App Registration | Enterprise Application |
|---|---|---|
| Location | Tenant where app is defined | Every tenant where app is used |
| Purpose | Define app identity, permissions, redirect URIs | Consent record; user/group assignment |
| Relation | One app registration → one or more enterprise apps | Auto-created in tenant when app is used |
client_id, secret/certificate, API permissions (delegated vs application)| Type | Lifecycle | Reuse | Best For |
|---|---|---|---|
| System-assigned | Deleted with resource | Cannot reuse | Simple single-resource scenarios |
| User-assigned | Independent | Reusable across resources | Shared identity, pre-authorization, AKS Workload Identity |
Storage Blob Data Contributor)DefaultAzureCredential — automatically picks up Managed Identity token in Azure| Scope Level | Example |
|---|---|
| Management Group | All subscriptions in organization |
| Subscription | All resource groups in subscription |
| Resource Group | All resources in resource group |
| Resource | Single resource (e.g., one storage account) |
Owner (full + can grant access), Contributor (full except access mgmt), Reader (read-only)Microsoft.Storage/storageAccounts/read)