Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are developing a C# ASP.NET Core web application that will be hosted on an Azure App Service. The application must securely query data from an Azure SQL Database. You decide to use a user-assigned managed identity to authenticate the App Service to the database to ensure that database credentials are not hardcoded. Which sequence of steps should you perform to provision the identity, associate it with the App Service, and configure the database access permissions?

  1. 1Create a user-assigned managed identity in Microsoft Entra ID.
  2. 2Associate the user-assigned managed identity with the Azure App Service instance.
  3. 3Connect to the Azure SQL Database using a Microsoft Entra ID administrator account.
  4. 4Execute the T-SQL statement `CREATE USER [IdentityName] FROM EXTERNAL PROVIDER` to create a database user representing the managed identity.
  5. 5Add the database user to the `db_datareader` database role to grant read permissions.

Answer

The correct order of operations is to first create the user-assigned managed identity, then associate it with the App Service, establish an administrative connection to the SQL Database, create a database user mapped to the external provider identity, and lastly assign the database user to the db_datareader role.
The correct sequence begins with provisioning the user-assigned managed identity so it exists in Microsoft Entra ID. Next, this identity is associated with the App Service resource. To configure permissions, an administrator must log into the target database, create a containment user representing the identity, and finally add that user to the db_datareader role.

Step-by-Step Solution

1
Create the user-assigned managed identity.
A managed identity is registered as a standalone resource in Microsoft Entra ID.
This establishes a security principal that can be associated with resources and granted permissions.
2
Associate the user-assigned managed identity with the App Service.
The App Service is configured to run under the context of the user-assigned managed identity.
The hosting environment requires the identity association to make the identity's credentials available to the application's runtime.
3
Connect to the database using a Microsoft Entra ID admin account.
An administrative database session is initialized.
Creating external database users requires administrator-level access to the database.
4
Run the CREATE USER statement with the EXTERNAL PROVIDER clause.
A containment database user is created inside the SQL database.
This maps the database security principal to the external Microsoft Entra ID identity resource.
5
Add the containment user to the db_datareader database role.
The mapped database user receives read access to the database.
Role membership establishes the actual permissions needed by the application.

Key Concept

Configuring user-assigned managed identities involves registering the identity in the directory, associating it with the computing host, and mapping it to a database principal prior to assigning permissions.
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic