Examkin

Question

Difficulty: MediumSecure API Management Endpoints

You are configuring a secure architecture where an Azure API Management (APIM) instance gateway forwards client requests to a backend API hosted on an Azure App Service. The backend App Service is configured to require Microsoft Entra ID authentication and expects an OAuth token. You want to authenticate the APIM instance to the backend App Service using its system-assigned managed identity. Which two actions should you perform? (Choose two.)

  1. Enable the system-assigned managed identity for the APIM instance.Answer
  2. Add the <authentication-managed-identity resource="https://myapi.azurewebsites.net" /> policy to the <inbound> section of the APIM policy.Answer
  3. C
    Add the <authentication-managed-identity resource="https://myapi.azurewebsites.net" /> policy to the <outbound> section of the APIM policy.
  4. D
    Configure a user-assigned managed identity on the backend App Service and grant the APIM instance access to it.
  5. E
    Configure a Key Vault access policy to allow the backend App Service to retrieve the APIM instance client secret.

Answer

Enable the system-assigned managed identity for the APIM instance, and add the authentication-managed-identity policy with the resource URI to the inbound section of the APIM policy.
To authenticate to a backend service using a managed identity, you must first enable the system-assigned managed identity on the APIM instance. This enables the instance to request tokens from Microsoft Entra ID. Next, you must place the <authentication-managed-identity> policy in the inbound section of the APIM policy to request and attach the Entra ID token to the backend request.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the APIM instance resource.
This registers the APIM instance in Microsoft Entra ID and assigns it an identity.
The APIM instance requires an identity to request OAuth tokens.
2
Grant the APIM system-assigned managed identity the required role or access on the backend App Service.
Allows the backend service to validate and authorize the tokens presented by APIM.
The identity must have permission to access the backend resource.
3
Add the authentication-managed-identity policy to the inbound section of the APIM policy, specifying the resource URI of the backend service.
APIM requests a token for the specified resource and adds it to the authorization header before sending the request.
This policy must run before the request is forwarded to the backend.

Key Concept

Authenticating APIM with backend services using managed identity
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic