Your code that's running on the VM can request a token from the Azure Instance Metadata Service identity endpoint, accessible only from within the VM: http://169.254.169.254/metadata/identity/oauth2/token Reference:
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview