Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are deploying an ASP.NET Core web application to an Azure App Service. The application must retrieve secrets from an Azure Key Vault using a user-assigned managed identity. The application code uses DefaultAzureCredential from the Azure.Identity SDK to authenticate. Which sequence of steps should you perform to configure the environment and enable secure access?

  1. 1Create a user-assigned managed identity resource in your Azure subscription.
  2. 2Associate the user-assigned managed identity with the Azure App Service.
  3. 3Assign the Key Vault Secrets User role to the user-assigned managed identity on the Key Vault.
  4. 4Configure the AZURE_CLIENT_ID application setting on the App Service with the Client ID of the managed identity.

Answer

First, create the user-assigned managed identity. Second, associate the identity with the App Service. Third, assign the Key Vault Secrets User RBAC role to the identity on the Key Vault. Finally, configure the AZURE_CLIENT_ID application setting on the App Service with the identity's client ID.
Configuring a user-assigned managed identity requires a specific sequence: you must create the standalone identity resource, associate it with the App Service resource, grant the identity permission to access the Key Vault, and configure the AZURE_CLIENT_ID app setting. Setting the AZURE_CLIENT_ID environment variable is necessary because DefaultAzureCredential will not automatically know which user-assigned identity to use without it.

Step-by-Step Solution

1
Create the user-assigned managed identity resource.
A standalone identity resource is created with a unique Client ID and Principal ID.
The identity must exist in Microsoft Entra ID before it can be assigned to resources or granted RBAC roles.
2
Associate the identity with the App Service.
The App Service's identity configuration includes the resource ID of the user-assigned managed identity.
This configuration allows the App Service infrastructure to obtain Entra ID tokens on behalf of the user-assigned managed identity.
3
Assign the Key Vault Secrets User RBAC role to the identity's service principal.
The identity is authorized to access secrets within the Key Vault.
Azure Key Vault requires explicit data-plane permissions for identities to retrieve secrets.
4
Set the AZURE_CLIENT_ID environment variable in the App Service app settings.
The application's runtime environment includes the AZURE_CLIENT_ID setting.
DefaultAzureCredential requires this environment variable to distinguish between multiple potential identities when acquiring tokens for a user-assigned managed identity.

Key Concept

Configuration workflow for user-assigned managed identities with DefaultAzureCredential
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic