You are configuring an Azure App Service web app named app-finance to securely retrieve database credentials stored in an Azure Key Vault. You want to use a system-assigned managed identity to authenticate the web app. Which two configurations are required to complete this setup? (Select two.)
- Enable a system-assigned managed identity on the Azure App Service web app.Answer
- Configure an access policy in Azure Key Vault that grants Get secret permission to the web app's managed identity.Answer
- CEnable a system-assigned managed identity on the Azure Key Vault instance.
- DCreate an application setting in the web app using the Key Vault reference syntax pointing to the Key Vault client ID.
Answer
To allow the web app to securely retrieve secrets from Azure Key Vault, you must enable a system-assigned managed identity on the App Service web app and configure an access policy in Key Vault granting the identity Get secret permission.
To retrieve secrets, the App Service web app needs an identity to authenticate with Microsoft Entra ID, which is achieved by enabling a system-assigned managed identity on the web app. Once configured, the Key Vault must trust and authorize this identity, which requires creating an access policy in the Key Vault that grants Get secret permission to the web app's identity.
Step-by-Step Solution
Key Concept
Configuring Azure App Service managed identity and Key Vault access permissions.