Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are developing an ASP.NET Core web application hosted on an Azure App Service. The application must retrieve database connection strings from an Azure Key Vault. The security architecture requires that:

1. The application must authenticate to Azure Key Vault without storing any credentials or secrets in code or configuration files.
2. The identity used for authentication must be shared across multiple web applications in the same environment to simplify access control management.

Which configuration should you implement to meet these requirements?

  1. A
    Enable a system-assigned managed identity on the App Service, assign it the Key Vault Secrets User role on the Key Vault, and configure the App Service application settings.
  2. B
    Create an App Registration in Microsoft Entra ID, configure a client secret, store the secret in the App Service application settings, and grant it permissions on the Key Vault.
  3. Create a user-assigned managed identity, assign it the Key Vault Secrets User role on the Key Vault, associate the identity with the App Service, and configure the client ID in the application settings.Answer
  4. D
    Create a user-assigned managed identity, associate it with the App Service, and configure Key Vault access policies to grant access to the App Service's default system identity.

Answer

Create a user-assigned managed identity, assign it the Key Vault Secrets User role on the Key Vault, associate the identity with the App Service, and configure the client ID in the application settings.
The correct option is to create a user-assigned managed identity, assign it the Key Vault Secrets User role, associate it with the App Service, and configure the client ID in the settings. This ensures the identity is shared across resources without storing secrets and allows DefaultAzureCredential to resolve the specified identity.

Step-by-Step Solution

1
Determine the type of managed identity that supports sharing across multiple Azure resources.
Identify that user-assigned managed identities are standalone Azure resources that can be shared across multiple App Services, unlike system-assigned managed identities which are tied 1:1 to a single resource.
This satisfies the requirement to share the identity and simplify access control management.
2
Select the correct permission assignment method to allow the identity to read secrets from Key Vault.
Assign the Key Vault Secrets User role to the user-assigned managed identity.
This grants the identity the minimum required permission to retrieve secret values without requiring administrative access.
3
Associate the identity with the App Service and configure the application to target it.
Add the user-assigned identity to the App Service, and set the client ID in the application settings so that DefaultAzureCredential in the code knows which identity to use.
This completes the binding and allows the SDK to resolve the correct token.

Key Concept

User-assigned managed identities allow for shared access across multiple Azure resources with an independent lifecycle from the resource, whereas system-assigned managed identities are restricted to a single resource.
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic