Examkin

Question

Difficulty: MediumMicrosoft Identity Platform Authentication

You are developing a C# console application that will run on multiple Azure Virtual Machines. The application must authenticate to the Microsoft Identity Platform and access Microsoft Graph using a managed identity. Because the application runs on multiple virtual machines, they must all share the same managed identity. You use MSAL.NET to implement the authentication code. You write the following code:

csharp
string clientId = "00000000-0000-0000-0000-000000000000";
string resource = "https://graph.microsoft.com";

// Initialize the managed identity application
IManagedIdentityApplication app = [Snippet 1]
.Build();

// Acquire the token
AuthenticationResult result = await app.[Snippet 2]
.ExecuteAsync();

Which two code segments should you use to complete the implementation? (Select two.)

  1. ManagedIdentityApplicationBuilder.Create(ManagedIdentityId.WithUserAssignedClientId(clientId))Answer
  2. AcquireTokenForManagedIdentity(resource)Answer
  3. C
    ManagedIdentityApplicationBuilder.Create(ManagedIdentityId.SystemAssigned)
  4. D
    AcquireTokenForClient(new string[] { resource })

Answer

Initialize the application using a user-assigned managed identity client ID and acquire the token using the dedicated managed identity token acquisition method.
To fulfill the requirement where multiple virtual machines share the same identity, a user-assigned managed identity must be used. In MSAL.NET, you instantiate this using the builder's Create method along with `ManagedIdentityId.WithUserAssignedClientId(clientId)`. To acquire the token, you must call the dedicated `AcquireTokenForManagedIdentity` method passing the resource URI.

Step-by-Step Solution

1
Determine the type of managed identity required based on sharing requirements.
Since multiple virtual machines must share the identity, a user-assigned managed identity is selected.
System-assigned managed identities are locked to a single resource lifecycle and cannot be shared across resources.
2
Construct the managed identity configuration using the user-assigned client ID in MSAL.NET.
Use ManagedIdentityApplicationBuilder.Create with ManagedIdentityId.WithUserAssignedClientId.
This registers the user-assigned identity's client ID with the MSAL builder.
3
Use the correct token acquisition method for managed identity applications.
Invoke the AcquireTokenForManagedIdentity method on the application object.
Managed identity token requests in MSAL.NET use AcquireTokenForManagedIdentity rather than client credentials or public client methods.

Key Concept

Acquiring tokens via MSAL.NET using a user-assigned managed identity for shared workloads.
Estimated Time:2m 0s
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic