Examkin

Question

Difficulty: EasyApp Registrations and Service Principals

You are developing a daemon application that runs on an on-premises physical server. The application must authenticate programmatically to Azure Key Vault to retrieve secrets. You need to configure the identity for this application. Which identity configuration should you use?

  1. A
    Enable a system-assigned managed identity on the on-premises physical server.
  2. B
    Create a user-assigned managed identity in Microsoft Entra ID and assign it to the on-premises application.
  3. Register an application in Microsoft Entra ID to create a service principal, and authenticate using a certificate or client secret.Answer
  4. D
    Generate a Shared Access Signature (SAS) token in Microsoft Entra ID and configure the application to authenticate using the token.

Answer

Register an application in Microsoft Entra ID to create a service principal, and authenticate using a certificate or client secret.
For workloads hosted on-premises, a standard application registration must be created in Microsoft Entra ID. This registration creates an application object and a service principal. The application can then authenticate programmatically using a client secret or certificate credentials to obtain Entra ID tokens and access Azure resources like Key Vault.

Step-by-Step Solution

1
Identify the hosting environment of the daemon application.
The application runs on an on-premises physical server, which is outside the Azure boundary.
Managed identities are designed for applications running within Azure on supported resources. On-premises workloads require a standard registration.
2
Select the appropriate Microsoft Entra ID identity type.
An application registration is created, which generates a corresponding service principal in the tenant.
The service principal acts as the security principal representing the application identity in Microsoft Entra ID.
3
Configure credentials for the service principal.
Generate a client secret or upload a certificate associated with the application registration.
The daemon application on-premises will use these credentials to acquire tokens from Microsoft Entra ID to access Azure Key Vault.

Key Concept

App Registrations and Service Principals vs Managed Identities
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic