An Azure App Service web app uses a system-assigned managed identity to load configuration from an Azure App Configuration store. The App Configuration store contains a Key Vault reference that points to a secret stored in Azure Key Vault. While the web app successfully retrieves standard key-value settings, it fails to resolve the Key Vault reference at runtime. Which configuration change is required to allow the web app to resolve the Key Vault reference?
- AGrant the system-assigned managed identity of the Azure App Configuration store the Secret Get permission on the Key Vault.
- BGrant the web app's managed identity the App Configuration Data Owner role on the App Configuration store.
- Grant the system-assigned managed identity of the web app the Secret Get permission on the Key Vault.Answer
- DUpdate the Key Vault reference value in the App Configuration store to include the web app's resource ID in place of the secret URI.
Answer
Grant the system-assigned managed identity of the web app the Secret Get permission on the Key Vault.
The correct approach is to grant the system-assigned managed identity of the web app the Secret Get permission on the Key Vault. Key Vault references stored in Azure App Configuration are not resolved by the App Configuration service itself. Instead, the application's configuration provider fetches the reference metadata (the secret URI) from the App Configuration store, and then the application uses its own credentials to fetch the actual secret value directly from the Key Vault. Therefore, the web app's identity must have read access to the Key Vault.
Step-by-Step Solution
Key Concept
Key Vault references in Azure App Configuration are resolved by the client application at runtime, requiring the application's identity to have access permissions on the target Key Vault.