Examkin

Question

Difficulty: HardConfigure Azure App Service Web Apps

Your company deploys an Azure App Service web app named webapp-prod. The web app must retrieve a database connection string securely from an Azure Key Vault named kv-prod. You configure a user-assigned managed identity named id-webapp for webapp-prod and grant it the Key Vault Secrets User role on kv-prod. You need to configure the App Service application settings so that the web app can retrieve the latest version of the secret named DbConnectionString using the user-assigned identity. Which of the following configurations should you apply to the App Service application settings?

  1. A
    Configure the DbConnectionString setting with the value @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbConnectionString;Identity=id-webapp).
  2. B
    Configure the DbConnectionString setting with the value @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbConnectionString) and add an application setting named managedIdentityClientId set to the client ID of the user-assigned managed identity.
  3. Configure the DbConnectionString setting with the value @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbConnectionString) and add an application setting named keyVaultReferenceIdentity set to the resource ID of the user-assigned managed identity.Answer
  4. D
    Configure the DbConnectionString setting with the value @Microsoft.KeyVault(SecretUrl=https://kv-prod.vault.azure.net/secrets/DbConnectionString) and add an application setting named keyVaultReferenceIdentity set to the resource ID of the user-assigned managed identity.

Answer

Configure the DbConnectionString setting with the value @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbConnectionString) and add an application setting named keyVaultReferenceIdentity set to the resource ID of the user-assigned managed identity.
The correct configuration uses the standard `@Microsoft.KeyVault(SecretUri=...)` syntax to point to the secret URI. Additionally, because the application uses a user-assigned managed identity, the `keyVaultReferenceIdentity` application setting must be added, with its value set to the resource ID of that user-assigned managed identity, to let App Service know which identity to use to authenticate to the Key Vault.

Step-by-Step Solution

1
Define the Key Vault reference in the application setting value.
The application setting is defined as @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbConnectionString).
This uses the correct syntax and standard SecretUri parameter format to tell App Service where to retrieve the secret.
2
Configure App Service to use the user-assigned managed identity for resolution.
The keyVaultReferenceIdentity application setting is added with the user-assigned managed identity's resource ID as its value.
By default, App Service attempts to use the system-assigned identity. To use a user-assigned identity, you must set the keyVaultReferenceIdentity app setting to point to the resource ID of the user-assigned identity.

Key Concept

Key Vault references in Azure App Service allow applications to securely retrieve secrets without exposing them in configuration. When using user-assigned managed identities, you must configure the keyVaultReferenceIdentity setting alongside the reference.
Estimated Time:2m 0s
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic