Examkin

Question

Difficulty: Very hardCreate and Configure Azure Functions

An enterprise architecture requires that an Azure Function App (V4 runtime, .NET 8 isolated worker model) connects to an Azure Event Hubs namespace named 'fin-data-eh' without using any secrets or connection strings. The Function App uses a user-assigned managed identity to access the Event Hubs namespace, and the identity has been granted the Azure Event Hubs Data Receiver role. In the function code, the trigger attribute uses a connection property named `EventHubConnection`. Which configuration settings must be added to the application settings of the Function App to authenticate the trigger using the user-assigned managed identity?

  1. A
    Configure only `EventHubConnection__fullyQualifiedNamespace` with the value `fin-data-eh.servicebus.windows.net` and leave other identity connection properties unset.
  2. B
    Configure `EventHubConnection` with a Key Vault reference syntax `@Microsoft.KeyVault(SecretUri=https://fin-vault.vault.azure.net/secrets/EventHubConnectionString)` and assign the user-assigned managed identity to the Function App.
  3. Configure `EventHubConnection__fullyQualifiedNamespace` with the value `fin-data-eh.servicebus.windows.net`, `EventHubConnection__credential` with the value `managedidentity`, and `EventHubConnection__clientId` with the Client ID of the user-assigned managed identity.Answer
  4. D
    Migrate the Function App to a Dedicated (App Service) hosting plan, then configure `EventHubConnection__fullyQualifiedNamespace` with the value `fin-data-eh.servicebus.windows.net` and `EventHubConnection__identity` with the user-assigned managed identity's Resource ID.

Answer

Configure EventHubConnection__fullyQualifiedNamespace with the value fin-data-eh.servicebus.windows.net, EventHubConnection__credential with the value managedidentity, and EventHubConnection__clientId with the Client ID of the user-assigned managed identity.
To configure a user-assigned managed identity for an identity-based connection in Azure Functions V4, you must specify the fully qualified namespace of the target service, set the credential type to 'managedidentity', and specify the Client ID of the user-assigned identity using the designated double-underscore environment variable syntax.

Step-by-Step Solution

1
Identify the required endpoint setting for identity-based connections in Azure Functions V4.
The setting EventHubConnection__fullyQualifiedNamespace must be defined with the service namespace URL.
Identity-based connections require the fully qualified domain address of the target service rather than a full connection string.
2
Determine how to target a user-assigned managed identity instead of the system-assigned default.
The setting EventHubConnection__credential must be set to 'managedidentity', and EventHubConnection__clientId must be set to the specific Client ID.
By default, the runtime attempts to use the system-assigned managed identity. To override this, the credential type and user-assigned client ID must be explicitly configured.
3
Evaluate the hosting plan capabilities and trigger connection settings structure.
Confirm that the Consumption and Premium hosting plans natively support identity-based connections without changing the plan.
Hosting plan migration is not required as identity-based connections are supported across serverless plans.

Key Concept

Azure Functions identity-based connections and user-assigned managed identity configuration
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic