> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Create and manage workload identities

Use this page to create, view, edit, enable, disable, and delete workload identities. For an introduction to workload identities and the problems they solve, see [Workload identities](/docs/authentication-and-security/workload-identities.md). To configure authentication, claims, and resource server access for a workload identity, see [Configure workload identity authentication](/docs/authentication-and-security/workload-identities/configure-workload-identity-management.md).

## Prerequisites

Before you manage workload identities, ensure you meet the following requirements:

- Your role includes the **Workload Identity Management** permission. The view, add, edit, and remove actions each control a specific operation.
- To assign groups to a workload identity, your role can manage those groups. Group assignment is optional.
- To view the audit history for a workload identity, your role also includes the **Reports** view permission.

## Create a workload identity

When you create a workload identity, IDaaS generates its OIDC application and client credentials automatically.

1. Click Menu icon **>** **Members > Workload Identity**. The **Workload Identities** page appears.
2. Click Circle Plus icon. The **Add Workload Identity** page appears.
3. Enter a **Name** for the workload identity. The name is required and must be unique.
4. Optional: Enter a **Description** that explains the purpose of the workload identity.
5. Optional: Enter an **Owner** to identify the person or team responsible for the workload identity.
6. Optional: In the **Groups** section, select a group from the list to assign it to the workload identity.
   - Repeat to assign more groups.
   - To remove an assigned group, click Trash icon next to the group.
7. Click **Save**. IDaaS creates the workload identity and its associated OIDC application, then opens the workload identity details page.

info

If the default OIDC signing certificate is unavailable, IDaaS uses another available certificate for the workload's OIDC application and displays a message that identifies the certificate it used.

## View workload identities

The **Workload Identities** page lists the workload identities you can manage based on your role and group assignments.

1. Click Menu icon **>** **Members > Workload Identity**. The **Workload Identities** page appears.
2. Review the following information for each workload identity:
   - **State.** Indicates whether the workload identity is active or disabled.
   - **Name.** The name of the workload identity. Click the name to open its details.
   - **Last Authentication Time.** The most recent time the workload authenticated. Displays as not available if the workload has never authenticated.
   - **Created.** The date and time the workload identity was created.

## Sort and filter workload identities

You can sort and filter the list to find a specific workload identity.

1. Click Menu icon **>** **Members > Workload Identity**. The **Workload Identities** page appears.
2. You can do the following actions:
   - Click the arrow next to the **Name** column heading to sort the list alphabetically.
   - Click Search icon to enable filtering, then filter by name, state, or group. Select your filter options and click **Apply**.
   - To select multiple workload identities, select the checkbox next to each one.

## Edit a workload identity

You can update a workload identity's name, description, owner, and group assignments from the **Profile** tab.

1. Click Menu icon **>** **Members > Workload Identity**. The **Workload Identities** page appears.
2. Click the name of the workload identity you want to edit. The details page appears with the **Profile** tab selected.
3. Update the **Name**, **Description**, or **Owner** as required.
4. In the **Groups** section, add or remove group assignments as required.
5. Click **Save**.

## Enable or disable a workload identity

Disabling a workload identity prevents it from authenticating without deleting it. You can enable it again later.

1. Click Menu icon **>** **Members > Workload Identity**. The **Workload Identities** page appears.
2. Do one of the following:
   - To disable an active workload identity, click Square icon for that workload identity.
   - To enable a disabled workload identity, click Play icon for that workload identity.
3. Confirm the action on the prompt.

tip

To change the state of several workload identities at once, select their checkboxes and use the enable or disable action in the toolbar. You can also change the state from the **Profile** tab by using the active toggle.

## Delete a workload identity

Deleting a workload identity also removes its associated OIDC application. You cannot delete the OIDC application on its own.

1. Click Menu icon **>** **Members > Workload Identity**. The **Workload Identities** page appears.
2. Click Trash icon for the workload identity you want to delete.
3. Click **Delete** on the confirmation prompt.

warning

Deleting a workload identity is permanent. Any service that relies on the workload's client credentials can no longer authenticate.

## Next steps

- Configure how the workload authenticates, and grant it access to resource servers. See [Configure workload identity authentication](/docs/authentication-and-security/workload-identities/configure-workload-identity-management.md).
- Assign roles that grant the **Workload Identity Management** permission to the administrators who manage workload identities. See [Create, assign, and manage roles](/docs/people-and-access/manage-members/create-assign-and-manage-roles.md).
- Organize workload identities with groups. See [Create and manage groups](/docs/people-and-access/manage-members/create-and-manage-groups.md).