Examkin

Question

Difficulty: HardSystem-Assigned and User-Assigned Managed Identities

You are developing an ASP.NET Core web application that will be hosted on two Azure App Service instances: web-app-primary and web-app-secondary. Both web apps must retrieve database connection strings from a shared Azure Key Vault named kv-shared. You decide to use a user-assigned managed identity named id-app-reader to access the Key Vault, ensuring that the identity's lifecycle is independent of the App Service instances. The application code uses the following C# code to authenticate:

csharp
var client = new SecretClient(new Uri("https://kv-shared.vault.azure.net/"), new DefaultAzureCredential());

To implement this security architecture, you assign id-app-reader to both App Service instances and configure the Key Vault access policy. Which of the following configuration steps must you also perform on each App Service instance to ensure that the application successfully authenticates?

  1. Add an Application Setting named AZURE_CLIENT_ID and set its value to the Client ID of the id-app-reader identity.Answer
  2. B
    Add an Application Setting named AZURE_CLIENT_ID and set its value to the Principal (Object) ID of the id-app-reader identity.
  3. C
    Add an Application Setting named AZURE_CLIENT_ID and set its value to the Resource ID of the id-app-reader identity.
  4. D
    Add an Application Setting named AZURE_MANAGED_IDENTITY_ID and set its value to the Client ID of the id-app-reader identity.

Answer

Add an Application Setting named AZURE_CLIENT_ID and set its value to the Client ID of the id-app-reader identity.
The correct action is to add an Application Setting named AZURE_CLIENT_ID and set its value to the Client ID of the id-app-reader identity. When an application uses DefaultAzureCredential and needs to authenticate with a user-assigned managed identity, it reads the AZURE_CLIENT_ID environment variable (which is populated via Application Settings in Azure App Service) to determine which identity to use. The Azure.Identity library expects the Client ID (App ID) of the identity.

Step-by-Step Solution

1
Assign the user-assigned managed identity to both Azure App Service instances.
The identity is linked to the App Service host environment, making it available for token requests.
This establishes the identity configuration at the Azure resource level.
2
Configure the Azure Key Vault access policies or Azure RBAC role assignments for the user-assigned managed identity.
The identity has the necessary permissions (e.g., Get/List Secrets) on the Key Vault.
This authorizes the identity to perform actions on the target resource.
3
Define the AZURE_CLIENT_ID Application Setting on each App Service instance pointing to the Client ID of the user-assigned managed identity.
DefaultAzureCredential reads this setting and uses it to specify the correct client ID during token acquisition.
When multiple identities are present or a user-assigned identity is used, DefaultAzureCredential requires the Client ID to differentiate and request tokens for the target identity.

Key Concept

Configuring DefaultAzureCredential for User-Assigned Managed Identities in Azure App Service
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic