Examkin

Question

Difficulty: MediumSecure API Management Endpoints

A company requires that all requests routed from Azure API Management (APIM) to a backend Azure App Service be authenticated using Microsoft Entra ID. You create a user-assigned managed identity named `apim-backend-identity` and link it to the APIM instance. You must configure the APIM policy so that it automatically requests an OAuth token using the user-assigned identity and includes it in requests to the backend service. How should you configure the APIM policy?

  1. A
    Configure the `<authentication-managed-identity>` policy inside the `<outbound>` section of the API policy, specifying both the backend API's resource URI and the client ID of the user-assigned managed identity.
  2. B
    Configure the `<authentication-managed-identity>` policy inside the `<inbound>` section of the API policy, specifying only the backend API's resource URI and omitting the client ID or identity ID.
  3. Configure the `<authentication-managed-identity>` policy inside the `<inbound>` section of the API policy, specifying both the backend API's resource URI and the client ID of the user-assigned managed identity.Answer
  4. D
    Implement a `<set-header>` policy inside the `<inbound>` section that retrieves credentials from Azure Key Vault using the `@Microsoft.KeyVault(...)` reference syntax, without configuring access policies for the managed identity.

Answer

Configure the `<authentication-managed-identity>` policy inside the `<inbound>` section of the API policy, specifying both the backend API's resource URI and the client ID of the user-assigned managed identity.
To authenticate requests to a backend API using a user-assigned managed identity, you must configure the `<authentication-managed-identity>` policy within the `<inbound>` section. Because a user-assigned identity is used, you must explicitly provide the client ID or identity ID of that identity. This allows the API Management gateway to successfully request a token for the specified resource and attach it to the request sent to the backend.

Step-by-Step Solution

1
Determine the correct policy processing stage.
The `<authentication-managed-identity>` policy must be placed in the `<inbound>` section.
This ensures the OAuth token is obtained and attached to the request before APIM forwards the request to the backend service.
2
Configure the policy with the identity's client ID.
Specify the `client-id` (or `identity-id`) of the user-assigned managed identity inside the policy attributes.
User-assigned managed identities must be explicitly identified in the policy. Otherwise, APIM defaults to using the system-assigned identity.

Key Concept

Securing backend services in Azure API Management using user-assigned managed identities.
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic