You are developing a C# .NET 8 application hosted on an Azure App Service. The application must access both an Azure Key Vault and an Azure SQL Database.
You have the following security and lifecycle requirements:
- The credentials used to access the Key Vault must be unique to the App Service instance and must be automatically deleted if the App Service is deleted.
- The credentials used to access the SQL Database must be shared with another App Service instance in a different region and must persist even if the primary App Service is deleted.
To meet these requirements, you enable a system-assigned managed identity on the App Service and grant it access to the Key Vault. You also create a user-assigned managed identity, assign it to the App Service, and grant it access to the SQL Database.
In your application code, you instantiate the clients using the parameterless DefaultAzureCredential constructor from the Azure.Identity library. During testing, the application successfully retrieves secrets from the Key Vault, but attempts to connect to the SQL Database fail with an access denied error.
Which modification must you make to resolve the SQL Database connection failure?
- AModify the App Service configuration to use only the system-assigned identity and grant it permissions to the SQL Database, as DefaultAzureCredential cannot support using multiple identity types on the same host.
- Instantiate the credential for the SQL Database client by passing a DefaultAzureCredentialOptions object with its ManagedIdentityClientId property set to the client ID of the user-assigned managed identity.Answer
- CConfigure a Key Vault access policy that explicitly grants permissions to the user-assigned managed identity, as the system-assigned identity's token is blocked when a user-assigned identity is also present.
- DUse ManagedIdentityCredential with the system-assigned identity's client ID for the Key Vault client, and leave the SQL Database client using the parameterless DefaultAzureCredential constructor.