Which endpoint does a managed identity use to obtain a token from inside an Azure resource?
- A login.microsoftonline.com directly with a secret
- B The Instance Metadata Service / IDENTITY_ENDPOINT local endpoint (correct answer)
- C An on-premises STS
- D graph.microsoft.com
Shortcut: The platform exposes a local token endpoint reachable only from within the resource. The SDK calls it, and Azure attests the identity without any client secret.