Question

Difficulty: MediumApp Registrations and Service Principals

You need to configure a local script to run nightly administrative tasks against Azure resources. The script must run non-interactively and authenticate using certificate-based authentication. Which sequence of steps must you perform to set up the authentication and test the connection?

  1. 1Generate a self-signed cryptographic certificate on the local system.
  2. 2Register the application in Microsoft Entra ID to create the application identity.
  3. 3Upload the public certificate file (.cer) to the Certificates & secrets section of the application registration.
  4. 4Assign the required Azure Role-Based Access Control (RBAC) role to the application's service principal at the resource scope.
  5. 5Execute the login command in the script using the application ID, tenant ID, and the path to the local certificate.

Answer

To set up certificate-based authentication, you must first generate the self-signed certificate, register the application in Microsoft Entra ID, upload the certificate public key, assign the required RBAC role to the service principal, and finally execute the login command using the certificate details.
The correct sequence starts with generating a certificate locally to obtain a public key. Then, the application is registered in Microsoft Entra ID to establish its identity. Next, the public key is uploaded to the application registration so Microsoft Entra ID can verify credentials. After that, the service principal is assigned an RBAC role to grant the necessary resource permissions. Finally, the script executes the login command using the certificate path, verifying the configuration.

Step-by-Step Solution

1
Generate a self-signed certificate locally.
A private key (retained locally) and a public key certificate (.cer file) are created.
The public key certificate is required to configure the application registration credential.
2
Create the application registration in Microsoft Entra ID.
An application object and a corresponding service principal are created in the Microsoft Entra tenant.
This establishes the identity that will be used by the automation script.
3
Upload the public key (.cer) to the application registration's Certificates & secrets.
The public key is associated with the application registration.
This allows Microsoft Entra ID to validate authentication requests signed by the private key.
4
Assign an RBAC role to the service principal.
The service principal is authorized to perform operations on the specified Azure resources.
Establishing identity is not enough; the service principal must be explicitly authorized to access resources.
5
Run the login command with the certificate details.
The script successfully authenticates and receives an access token.
This verifies that the identity, credentials, and RBAC permissions are correctly configured.

Key Concept

Configuring certificate-based authentication for service principals to enable secure, non-interactive scripting and automation.
Rate this question