Examkin

Question

Difficulty: EasySystem-Assigned and User-Assigned Managed Identities

You are developing a web application hosted on an Azure App Service. The application must retrieve database connection strings securely from an Azure Key Vault using a system-assigned managed identity.

Which three actions should you perform in sequence to configure this security access? To answer, drag the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  1. 1Enable the system-assigned managed identity on the Azure App Service instance.
  2. 2Assign the Key Vault Secrets User role to the App Service's managed identity at the Key Vault scope.
  3. 3Configure the web application code to authenticate using the DefaultAzureCredential class and retrieve the secret.

Answer

First, enable the system-assigned managed identity on the Azure App Service instance. Next, assign the Key Vault Secrets User role to the App Service's managed identity at the Key Vault scope. Finally, configure the web application code to authenticate using the DefaultAzureCredential class and retrieve the secret.
To grant an App Service access to Key Vault via managed identity: 1) Enable the system-assigned identity on the App Service, creating the principal. 2) Grant that principal permissions via Key Vault Secrets User role assignment. 3) Configure application code using DefaultAzureCredential to automatically pick up the identity environment and authorize calls.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Azure App Service.
Azure creates a service principal in Microsoft Entra ID linked directly to the lifecycle of the App Service.
Before permissions can be granted or authentication can happen, the managed identity must be enabled to generate its identity principal.
2
Assign the Key Vault Secrets User role to the managed identity.
The identity is authorized to read secrets from the Key Vault.
Having an identity is not enough; the resource owner must grant it the necessary Role-Based Access Control (RBAC) permissions to access the secrets.
3
Update application code to use DefaultAzureCredential.
The application successfully retrieves secrets at runtime without hardcoded credentials.
DefaultAzureCredential automatically detects the system-assigned managed identity in the App Service environment and uses it to request tokens.

Key Concept

Configuring a system-assigned managed identity to access Azure Key Vault securely.
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic