Examkin

Question

Difficulty: HardMicrosoft Identity Platform Authentication

You are developing a background worker service in C# that runs as a containerized application within Azure Container Apps. The service must run on a schedule without user interaction and authenticate to the Microsoft Identity Platform to read files from Microsoft Graph.

To comply with security policies, you must use Azure Managed Identities for authentication. The credentials must persist independently of the containerized app's lifecycle, allowing the container instances to be deleted, recreated, or scaled across different resource groups without requiring permissions to be reconfigured in Microsoft Entra ID.

Which approach should you use to implement this authentication?

  1. A
    Enable a system-assigned managed identity on the Azure Container App. Grant the identity the required Microsoft Graph application permissions, and initialize DefaultAzureCredential in your code without specifying a client ID.
  2. Create a user-assigned managed identity as a standalone Azure resource. Grant this identity the required Microsoft Graph application permissions, associate it with the Azure Container App, and initialize DefaultAzureCredential by passing the client ID of the user-assigned managed identity.Answer
  3. C
    Register a confidential client application in Microsoft Entra ID and generate a client secret. Store the secret in Azure App Configuration, reference it in the worker service using the syntax @Microsoft.KeyVault(SecretUri=...), and build the client using ConfidentialClientApplicationBuilder.
  4. D
    Create a Shared Access Signature (SAS) token in the Microsoft Entra ID portal with the Directory.Read.All scope, store it in the application's configuration, and authenticate using PublicClientApplicationBuilder.

Answer

Create a user-assigned managed identity as a standalone Azure resource. Grant this identity the required Microsoft Graph application permissions, associate it with the Azure Container App, and initialize DefaultAzureCredential by passing the client ID of the user-assigned managed identity.
The correct approach is to create a user-assigned managed identity. A user-assigned managed identity is created as a standalone Azure resource and has its own lifecycle independent of the Azure Container App. If the container app is deleted or recreated, the user-assigned identity and its assigned Microsoft Graph permissions persist. When initializing DefaultAzureCredential in code, the client ID of the user-assigned managed identity must be specified to ensure the SDK authenticates with the correct identity.

Step-by-Step Solution

1
Create a user-assigned managed identity in Azure.
A standalone identity resource is generated with its own Client ID and Object ID, separate from the container app.
To ensure that the identity credentials persist even if the hosting container app is deleted or redeployed.
2
Grant the user-assigned managed identity the required Microsoft Graph application permissions.
The identity is authorized to access Microsoft Graph APIs directly without user intervention.
Because the background worker service runs automatically on a schedule and cannot perform interactive user login.
3
Associate the user-assigned managed identity with the Azure Container App and configure the C# application to use it.
The Container App gets access to the identity, and DefaultAzureCredential is initialized using the client ID of the user-assigned managed identity.
To ensure the Azure SDK/MSAL resolves to the correct user-assigned identity instead of attempting to fall back to other credentials.

Key Concept

Managed Identities (system-assigned vs. user-assigned) and their lifecycle differences when authenticating to the Microsoft Identity Platform.
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic