Examkin

Question

Difficulty: Very hardSecure App Configuration and Key Vault References

You are developing an ASP.NET Core web application that will be hosted in an Azure App Service. The application must retrieve configuration settings from an Azure App Configuration store. Several settings in the store are Key Vault references pointing to secrets in Azure Key Vault. You must secure access using a single user-assigned managed identity, adhering to the principle of least privilege.

Which of the following represents the correct sequence of steps to configure the Azure resources and the web application?

  1. 1Create a user-assigned managed identity in Microsoft Entra ID.
  2. 2Associate the user-assigned managed identity with the Azure App Service web app.
  3. 3Assign the App Configuration Data Reader role to the identity on the App Configuration store, and the Key Vault Secrets User role to the identity on the Key Vault.
  4. 4Add the AZURE_CLIENT_ID application setting to the App Service web app and set its value to the Client ID of the user-assigned managed identity.
  5. 5Configure the web app's startup code to connect to the App Configuration store using DefaultAzureCredential and enable Key Vault options.

Answer

The correct sequence starts with creating the user-assigned managed identity, associating it with the App Service web app, granting the identity the App Configuration Data Reader role on the App Configuration store and the Key Vault Secrets User role on the Key Vault, configuring the AZURE_CLIENT_ID application setting on the App Service, and finally updating the application startup code to use DefaultAzureCredential to connect to App Configuration and resolve Key Vault references.
The correct sequence ensures that the identity resource is established first, associated with the host compute resource, authorized via role-based access control (RBAC) to read configuration and Key Vault secrets, mapped to the environment via the standard client ID environment variable, and finally consumed by the application code using the DefaultAzureCredential.

Step-by-Step Solution

1
Create a user-assigned managed identity in Microsoft Entra ID.
A new managed identity resource is created with a unique Client ID and Principal ID.
You cannot perform role assignments or associate the identity with other Azure resources until the identity resource itself exists.
2
Associate the user-assigned managed identity with the Azure App Service web app.
The App Service web app is configured to use the user-assigned identity.
The web app must have the identity assigned so the hosting platform can request tokens on its behalf.
3
Assign the App Configuration Data Reader role to the identity on the App Configuration store, and the Key Vault Secrets User role to the identity on the Key Vault.
The managed identity is granted the minimum required permissions to read configuration keys and resolve Key Vault secrets.
Since Key Vault references in Azure App Configuration are resolved client-side by the application itself, the application's identity requires permissions to both services.
4
Add the AZURE_CLIENT_ID application setting to the App Service web app.
An environment variable with the identity's client ID is injected into the application's runtime context.
By default, DefaultAzureCredential attempts to use the system-assigned managed identity. Specifying the AZURE_CLIENT_ID environment variable forces it to use the correct user-assigned identity.
5
Configure the web app's startup code to connect to the App Configuration store using DefaultAzureCredential and enable Key Vault options.
The application successfully fetches the configuration and decrypts Key Vault references on startup.
The application code must explicitly register the App Configuration provider and pass DefaultAzureCredential to handle authentication.

Key Concept

Configuring secure client-side resolution of Azure App Configuration Key Vault references using a user-assigned managed identity.
Estimated Time:3m 0s
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic