Examkin

Question

Difficulty: MediumConfigure Azure App Service Web Apps

You are configuring an Azure App Service web app named app-orders-prod that must retrieve a database connection string from an Azure Key Vault named kv-orders-prod. The web app is configured with multiple user-assigned managed identities. One of these identities, named id-orders-kv-reader, has the resource ID /subscriptions/11111111-2222-3333-4444-555555555555/resourceGroups/rg-prod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id-orders-kv-reader and has been granted the Key Vault Secrets User role. You need to configure the connection string as an application setting using a Key Vault reference that specifies the correct managed identity. Which of the following app setting values should you use?

  1. A
    @Microsoft.KeyVault(SecretUri=https://kv-orders-prod.vault.azure.net/secrets/DbConnectionString/;Identity=id-orders-kv-reader)
  2. B
    @Microsoft.KeyVault(SecretUri=https://kv-orders-prod.vault.azure.net/secrets/DbConnectionString/)
  3. @Microsoft.KeyVault(SecretUri=https://kv-orders-prod.vault.azure.net/secrets/DbConnectionString/;UserAssignedIdentity=/subscriptions/11111111-2222-3333-4444-555555555555/resourceGroups/rg-prod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id-orders-kv-reader)Answer
  4. D
    @Azure.KeyVault(SecretUri=https://kv-orders-prod.vault.azure.net/secrets/DbConnectionString/;UserAssignedIdentity=id-orders-kv-reader)

Answer

The setting value starting with @Microsoft.KeyVault and containing the UserAssignedIdentity parameter with the full resource ID of the managed identity.
The correct app setting value uses the '@Microsoft.KeyVault' prefix, references the secret using its URI ('SecretUri'), and explicitly specifies the resource ID of the user-assigned managed identity via the 'UserAssignedIdentity' parameter. This parameter is required when an App Service has multiple user-assigned managed identities configured, so the App Service knows which identity to use to authenticate against the Key Vault.

Step-by-Step Solution

1
Identify the correct namespace prefix for Key Vault references in App Service.
The reference must begin with '@Microsoft.KeyVault' to be parsed by the App Service token parser.
Prefixes like '@Azure.KeyVault' are syntactically invalid and will be treated as raw strings rather than dynamic references.
2
Determine the identity property name and value format needed for multiple user-assigned identities.
The property name must be 'UserAssignedIdentity', and the value must be the full Azure Resource Manager ID of the identity.
Short names or invalid parameter names like 'Identity' fail syntax validation, and omitting the identity leads to reference resolution errors when multiple user-assigned identities exist.
3
Combine the secret URI and identity details to construct the final reference string.
A semicolon-separated string containing 'SecretUri' and 'UserAssignedIdentity' is created.
This matches the official syntax requirements for user-assigned managed identities accessing Key Vault secrets via App Service configuration.

Key Concept

Azure App Service Key Vault References with User-Assigned Managed Identities
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic