Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are authoring an Azure Resource Manager (ARM) template to deploy an Azure App Service web app that needs to read secrets from an Azure Key Vault. During testing, developers will frequently delete and recreate the App Service web app. You must ensure that redeploying the web app does not require recreating Key Vault access policies or re-granting permissions.

Which configuration should you define in the resources section of the ARM template to enable the managed identity?

  1. Set the identity type to UserAssigned and define the resource ID of the existing user-assigned managed identity as a key in the userAssignedIdentities dictionary.Answer
  2. B
    Set the identity type to SystemAssigned and define the resource ID of the existing user-assigned managed identity as a key in the userAssignedIdentities dictionary.
  3. C
    Set the identity type to UserAssigned and define the client ID of the existing user-assigned managed identity as a key in the userAssignedIdentities dictionary.
  4. D
    Set the identity type to SystemAssigned and assign Key Vault permissions to the principal ID generated by the App Service resource.

Answer

Set the identity type to UserAssigned and define the resource ID of the existing user-assigned managed identity as a key in the userAssignedIdentities dictionary.
The correct configuration uses a user-assigned managed identity, which exists as a standalone Azure resource independent of the App Service web app. By configuring the identity type as 'UserAssigned' and referencing the identity's resource ID in the 'userAssignedIdentities' block, the web app can be deleted and redeployed without deleting the managed identity itself or breaking the Key Vault access policies configured for it.

Step-by-Step Solution

1
Analyze the lifecycle requirements of the scenario.
Since the App Service web app is frequently deleted and recreated, a system-assigned identity would be deleted along with the app, invalidating any Key Vault access policies. A user-assigned identity must be used because its lifecycle is independent of the resources it is assigned to.
Choosing the correct identity type prevents needing to recreate access policies on each redeployment.
2
Determine the proper ARM template schema configuration for a user-assigned managed identity.
The identity configuration block in an ARM template requires setting the 'type' property to 'UserAssigned' and using the fully-qualified resource ID of the identity as a key in the 'userAssignedIdentities' dictionary.
Using client IDs or system-assigned configurations will fail to deploy or will configure the wrong identity type.

Key Concept

Selecting and configuring the correct managed identity type (System-Assigned vs User-Assigned) based on lifecycle requirements and ARM template properties.
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic