Examkin

Question

Difficulty: HardConfigure Azure App Services

An administrator needs to configure automated backups for an Azure App Service web app named `app-orders-prod`. The web app runs on a Standard S1 App Service plan. Backups must be stored in an Azure Storage account named `storagecorp` that is configured with a firewall restricting access to selected networks.

The administrator attempts to configure the backup using a standard connection string, but the backup operation fails with a network access error.

Which configuration should you perform to enable successful backups of the web app to the storage account?

  1. A
    Configure regional virtual network integration for the web app and add the integration subnet to the allowed networks list in the firewall settings of the storage account.
  2. Configure a managed identity for the web app, assign the Storage Blob Data Contributor role to the identity on the storage account, and configure the storage account firewall to allow trusted Microsoft services.Answer
  3. C
    Upgrade the App Service plan to the Premium V3 tier and deploy a private endpoint for the storage account in a subnet integrated with the web app.
  4. D
    Generate a Shared Access Signature (SAS) token for the storage account with a 365-day expiration, and configure the backup settings to use the SAS token URL.

Answer

Configure a managed identity for the web app, assign the Storage Blob Data Contributor role to the identity on the storage account, and configure the storage account firewall to allow trusted Microsoft services.
To back up an Azure App Service web app to a storage account protected by a firewall, the backup operation must run as a trusted Microsoft service. This is accomplished by configuring a managed identity for the web app, assigning that identity the Storage Blob Data Contributor role on the destination storage account, and enabling the 'Allow trusted Microsoft services' bypass in the storage account firewall settings. This allows the platform's backup service to authenticate as the app and bypass the firewall.

Step-by-Step Solution

1
Enable a system-assigned or user-assigned managed identity on the App Service web app.
The web app is registered in Microsoft Entra ID with its own identity.
Managed identities are required for App Service backups to securely authenticate with a firewall-protected storage account.
2
Assign the Storage Blob Data Contributor role to the App Service's managed identity on the destination storage account.
The identity gains the required data-plane permissions to read, write, and delete blobs.
Standard control-plane roles like Owner or Contributor do not grant data plane access to upload backups.
3
Enable the 'Allow Azure services on the trusted services list to access this storage account' option in the storage account's firewall settings.
The storage account allows the App Service backup platform service to bypass network restrictions.
Since the backup service is managed by the platform, it uses the trusted Microsoft services path rather than the customer's VNet integration path.

Key Concept

Azure App Service backups to firewall-secured storage accounts require using managed identities and the trusted Microsoft services exception.
Estimated Time:2m 0s
Rate this question

Topics

Configure Azure App Services

More questions from this topic