Examkin

Question

Difficulty: HardDefine API Management Policies

You are configuring Azure API Management (APIM) to route requests to a secure backend Azure Function app. The backend function app requires Microsoft Entra ID authentication. You enable a user-assigned managed identity on the APIM instance, which has a client ID of `11111111-2222-3333-4444-555555555555`. You must configure APIM to authenticate against the backend function using this user-assigned managed identity. You define the following policy configuration:

xml
<policies>
<inbound>
<base />
<authentication-managed-identity resource="https://my-backend-function.azurewebsites.net" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
</outbound>
</policies>

When you test the API, requests to the backend fail with an HTTP 401 Unauthorized status. Which of the following modifications to the policy definition will resolve this issue?

  1. A
    Move the authentication-managed-identity element to the outbound section and add the client-id="11111111-2222-3333-4444-555555555555" attribute.
  2. B
    Omit the resource attribute in the inbound section to allow the policy to default to the function app's audience and use the system-assigned identity context.
  3. Add the client-id="11111111-2222-3333-4444-555555555555" attribute to the authentication-managed-identity element in the inbound section.Answer
  4. D
    Modify the policy to use the identity-id attribute pointing to an Azure Key Vault secret reference to retrieve the secret credentials of the identity.

Answer

Add the client-id attribute containing the user-assigned managed identity's client ID to the authentication-managed-identity element in the inbound section.
Specifying the client-id attribute with the user-assigned managed identity's client ID inside the authentication-managed-identity element in the inbound section tells API Management to use that specific identity to retrieve an access token. Because the policy is situated in the inbound section, the token is obtained and attached to the Authorization header before APIM forwards the request to the secure backend.

Step-by-Step Solution

1
Analyze the error context
The APIM instance is failing to authenticate against the secure backend function because the authentication policy is missing information about which identity to use.
By default, the authentication-managed-identity policy attempts to use the system-assigned managed identity if no client-id or identity-id is specified.
2
Identify the required identity configuration
The scenario explicitly states that the APIM instance has been configured with a user-assigned managed identity.
To use a user-assigned managed identity, the policy must explicitly provide the client ID or resource ID of that identity.
3
Determine the correct policy section placement
The authentication-managed-identity policy must execute in the inbound section.
The token must be acquired and attached to the request headers before the request is forwarded to the backend service. Doing this in the outbound section would be too late as the outbound section only processes responses.

Key Concept

API Management policies can use managed identities to acquire access tokens for backend services. When using user-assigned managed identities, the client ID or resource ID must be specified using the client-id or identity-id attributes in the inbound policy section.
Rate this question

Topics

Define API Management Policies

More questions from this topic