Examkin

Question

Difficulty: HardSecure API Management Endpoints

An enterprise application requires Azure API Management (APIM) to forward client requests to a backend web API that is secured via Microsoft Entra ID. The backend web API expects tokens containing the audience claim https://backend.contoso.com. To facilitate cross-environment deployments, you create a user-assigned managed identity named apim-identity and associate it with your APIM instance. You need to configure APIM to authenticate using this specific identity when calling the backend. Which configuration should you apply to the APIM policy?

  1. A
    Add the authentication-managed-identity policy inside the <outbound> policy block, setting the resource attribute to https://backend.contoso.com and the client-id attribute to the client ID of apim-identity.
  2. B
    Add the authentication-managed-identity policy inside the <inbound> policy block, setting the resource attribute to https://backend.contoso.com and omitting the client-id attribute to allow the request to fall back to the system-assigned managed identity.
  3. Add the authentication-managed-identity policy inside the <inbound> policy block, setting the resource attribute to https://backend.contoso.com and the client-id attribute to the client ID of apim-identity.Answer
  4. D
    Retrieve a client secret for apim-identity from Azure Key Vault using a named value, and then add a set-header policy inside the <inbound> policy block to inject the client secret into the Authorization header.

Answer

Add the authentication-managed-identity policy inside the <inbound> policy block, setting the resource attribute to https://backend.contoso.com and the client-id attribute to the client ID of apim-identity.
To authenticate to a backend API using a user-assigned managed identity, you must use the authentication-managed-identity policy. This policy must be configured in the inbound processing section so that the bearer token is attached to the request before it is forwarded to the backend. Because multiple user-assigned identities can be associated with an APIM instance, you must explicitly specify the client ID of the desired identity in the policy configuration.

Step-by-Step Solution

1
Identify the required policy to acquire a token using a managed identity.
The authentication-managed-identity policy is chosen.
This policy natively handles the acquisition and configuration of Entra ID access tokens for backend communication.
2
Determine the correct policy section for modifying the backend request.
The policy is placed in the inbound block.
To authenticate requests sent to the backend, the authorization token must be set before the request is forwarded by the gateway.
3
Configure the parameters to identify the user-assigned identity.
Set the resource attribute to the audience URI and the client-id attribute to the Client ID of the user-assigned identity.
Because an APIM instance can have multiple user-assigned identities, the client ID is required to specify which identity should acquire the token.

Key Concept

Securing API Management backend connections using a user-assigned managed identity.
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic