Examkin

Question

Difficulty: MediumDefine API Management Policies

An API gateway implemented via Azure API Management (APIM) needs to forward requests to a backend microservice secured by Microsoft Entra ID. The APIM instance is configured with a user-assigned managed identity named `apim-identity`. The backend service expects an Entra ID access token from this specific managed identity. Which policy configuration should you apply to authenticate requests using this user-assigned managed identity?

  1. A
    Place the <authentication-managed-identity resource="api://backend-app-id" client-id="00000000-0000-0000-0000-000000000000" /> policy inside the <outbound> section of the API policy XML.
  2. Place the <authentication-managed-identity resource="api://backend-app-id" client-id="00000000-0000-0000-0000-000000000000" /> policy inside the <inbound> section of the API policy XML.Answer
  3. C
    Place the <authentication-managed-identity resource="api://backend-app-id" /> policy (omitting the client-id attribute) inside the <inbound> section of the API policy XML.
  4. D
    Configure a <set-header> policy in the <inbound> section to retrieve the managed identity's client secret from Azure Key Vault using the {{secret-key-reference}} syntax.

Answer

Place the authentication-managed-identity policy with the specified resource and client-id attributes inside the inbound section of the API policy XML.
The correct answer configuration places the `<authentication-managed-identity>` policy in the `<inbound>` block, specifying the target backend application's audience scope via the `resource` attribute, and the `client-id` of the user-assigned managed identity. This configuration correctly retrieves the token prior to the request forwarding phase and instructs API Management which specific user-assigned identity to utilize.

Step-by-Step Solution

1
Determine the correct policy section for attaching authentication credentials to the backend request.
Identify the inbound policy section as the target because authentication tokens must be obtained and attached to the header before the request is transmitted to the backend microservice.
The outbound section is processed after the backend response has returned, which is too late to authorize the initial request.
2
Configure the policy attributes for a user-assigned managed identity.
Define the authentication-managed-identity policy, passing the backend application's resource URI and the client-id of the user-assigned managed identity.
Unlike system-assigned identities, user-assigned identities require the client-id or resource-id to be explicitly specified in order to locate the correct identity credentials.

Key Concept

Defining backend authentication policies in Azure API Management using user-assigned managed identities.
Rate this question

Topics

Define API Management Policies

More questions from this topic