You are developing an Azure App Service web app that needs to retrieve a database connection string stored as a secret in Azure Key Vault. You want to authenticate the web app using a system-assigned managed identity.
Which two actions should you perform to configure the required access? (Select two.)
- Enable a system-assigned managed identity on the App Service web app.Answer
- Create an access policy in Azure Key Vault that grants the Get permission for secrets to the web app's managed identity.Answer
- CCreate a user-assigned managed identity on the Key Vault and download its credential client secret to the web app's configuration settings.
- DConfigure the web app's application settings with a Key Vault reference using the syntax @Azure.KeyVault(SecretUri=secret_uri).
Answer
Enable a system-assigned managed identity on the App Service web app, and create an access policy in Azure Key Vault that grants the Get permission for secrets to the web app's managed identity.
To retrieve a secret using a system-assigned managed identity, you must first enable the identity on the App Service web app to register it with Microsoft Entra ID. Then, you must configure authorization on the Azure Key Vault (such as an access policy) to grant the web app's identity the Get permission for secrets.
Step-by-Step Solution
Key Concept
Configuring secure access to Key Vault secrets using managed identities