You need to configure an Azure App Service web app to retrieve application settings securely from an Azure Key Vault secret using a system-assigned managed identity. Which sequence of steps should you perform to complete this configuration?
- 1Enable the system-assigned managed identity on the Azure App Service web app.
- 2Create an access policy or Azure RBAC role assignment in the Azure Key Vault that grants Secret Get permissions to the web app's managed identity.
- 3Add a new application setting in the App Service web app that uses the `@Microsoft.KeyVault` reference syntax pointing to the secret URI.
Answer
To configure the retrieval of settings using a system-assigned managed identity, first enable the identity on the App Service web app to register its principal. Next, create a Key Vault access policy or role assignment that grants the identity Secret Get permissions. Finally, configure the web app's application settings using the Key Vault reference syntax.
The system-assigned managed identity must first be created on the App Service web app so its principal ID exists. Then, this principal must be granted Secret Get permissions in Key Vault. Finally, the application setting containing the Key Vault reference syntax is configured to successfully retrieve the secret.
Step-by-Step Solution
Key Concept
Integrating App Service Web Apps with Azure Key Vault using system-assigned managed identities.