Examkin

Question

Difficulty: Very hardConfigure Azure App Service Web Apps

You are configuring an Azure App Service web app named `app-finance` to retrieve database credentials from an Azure Key Vault named `kv-finance`. You want to use a user-assigned managed identity named `id-finance` to authenticate and resolve the Key Vault references in your application settings. You have already associated the user-assigned managed identity with the web app and granted it the `Key Vault Secrets User` role on `kv-finance`. However, when the application runs, the Key Vault references in the application settings fail to resolve, and the web app attempts to use a non-existent system-assigned identity instead of the user-assigned identity. What configuration step must you perform next to ensure the web app uses the user-assigned managed identity to resolve the Key Vault references?

  1. A
    Modify the Key Vault reference syntax in the application settings to append the identity Client ID as a parameter, such as `@Microsoft.KeyVault(SecretUri=https://kv-finance.vault.azure.net/secrets/db-pass/;Identity=id-finance)`.
  2. Set the site configuration property `keyVaultReferenceIdentity` of the web app to the resource ID of the user-assigned managed identity.Answer
  3. C
    Enable a system-assigned managed identity for the web app and grant it access to the Key Vault, because App Service Key Vault references do not support user-assigned managed identities.
  4. D
    Re-create the Key Vault secrets with an access policy specifically granting permissions to the App Service's default service principal rather than using Azure RBAC roles.

Answer

Set the site configuration property `keyVaultReferenceIdentity` of the web app to the resource ID of the user-assigned managed identity.
The correct answer is to configure the `keyVaultReferenceIdentity` site property with the resource ID of the user-assigned managed identity. Since an App Service web app can have multiple user-assigned managed identities, the platform cannot determine which one to use for resolving Key Vault references unless it is explicitly specified. Without this configuration, the platform defaults to using the system-assigned managed identity.

Step-by-Step Solution

1
Ensure the user-assigned managed identity is associated with the Azure App Service web app and has the necessary permissions (e.g., Key Vault Secrets User role) to read secrets from the Key Vault.
The identity is linked and authorized, but the app cannot yet use it for references automatically.
Before the app can fetch secrets, the chosen identity must have read permissions in the Key Vault.
2
Configure the site configuration property `keyVaultReferenceIdentity` to point to the resource ID of the user-assigned managed identity.
The App Service is configured to use the specified user-assigned identity to authenticate to Key Vault for reference resolution.
Since a web app can have multiple user-assigned identities associated with it, App Service requires you to explicitly designate which identity to use for resolving Key Vault references.
3
Restart the App Service web app or trigger a configuration update to apply the changes.
The environment variables are updated and the Key Vault references successfully resolve to the secret values.
App Service resolves Key Vault references at startup or when configuration changes are applied.

Key Concept

Azure App Service Key Vault reference identity configuration
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic