Examkin

Question

Difficulty: HardConfigure Azure App Service Web Apps

You are configuring an Azure App Service web app named `prod-webapp` to retrieve a database connection string from an Azure Key Vault named `prod-vault`. The secret in the Key Vault is named `DbConnectionString`. The web app must retrieve the secret using a user-assigned managed identity named `app-identity` (resource ID: `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-identity`). No system-assigned identity is enabled on the web app. Which two of the following configurations are required to ensure the web app can successfully retrieve the secret? (Select TWO.)

  1. Set the `DbConnectionString` application setting to `@Microsoft.KeyVault(SecretUri=https://prod-vault.vault.azure.net/secrets/DbConnectionString/)`Answer
  2. Configure the web app's `keyVaultReferenceIdentity` property to the resource ID of the `app-identity` user-assigned managed identity.Answer
  3. C
    Set the `DbConnectionString` application setting to `@Microsoft.KeyVault(SecretUri=https://prod-vault.vault.azure.net/secrets/DbConnectionString/;Identity=app-identity)`
  4. D
    Grant the web app's system-assigned managed identity the Get permission on secrets in `prod-vault`.

Answer

To retrieve the secret successfully, you must configure the application setting using the correct Key Vault reference syntax `@Microsoft.KeyVault(SecretUri=...)` and configure the web app's `keyVaultReferenceIdentity` property to the resource ID of the user-assigned managed identity.
To retrieve a secret using a Key Vault reference in Azure App Service with a user-assigned managed identity, you must perform two main configurations: first, format the application setting value using the correct Key Vault reference syntax (e.g., using `@Microsoft.KeyVault(SecretUri=...)` or `@Microsoft.KeyVault(VaultName=...;SecretName=...)`). Second, configure the web app's `keyVaultReferenceIdentity` property to point to the resource ID of the user-assigned identity. This instructs the App Service to use that specific user-assigned identity to authenticate against the Key Vault.

Step-by-Step Solution

1
Define the Application Setting `DbConnectionString` using the standard Key Vault reference format.
The setting references the secret URL `https://prod-vault.vault.azure.net/secrets/DbConnectionString/`.
This tells the App Service runtime to resolve the value from Key Vault rather than storing it in plain text.
2
Configure the App Service Web App to use the user-assigned identity for resolving Key Vault references.
The web app's `keyVaultReferenceIdentity` configuration is set to the resource ID of `app-identity`.
Since a user-assigned managed identity is used, App Service needs to know which identity to present when fetching Key Vault references.

Key Concept

Configuring Key Vault references in Azure App Service using user-assigned managed identities.
Estimated Time:2m 0s
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic