Examkin

Question

Difficulty: HardConfigure Azure App Service Web Apps

You are deploying a web application to an Azure App Service web app named app-inventory. The application must retrieve a database connection string from an Azure Key Vault named kv-prod.

You have the following requirements:
- Authenticate to the Key Vault using a user-assigned managed identity named id-inventory.
- Configure the application settings of the web app to retrieve the credential using a Key Vault reference.
- Ensure the configuration automatically retrieves the latest version of the secret.

Which two actions must you perform to configure the web app? (Choose two.)

  1. Grant the id-inventory user-assigned managed identity a Key Vault access policy with Secret Get permissions on kv-prod.Answer
  2. Set the keyVaultReferenceIdentity configuration property of the web app to the resource ID of the id-inventory managed identity.Answer
  3. C
    Set the value of the application setting to @KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbConnectionString).
  4. D
    Enable a system-assigned managed identity on the web app and grant it permissions to kv-prod.
  5. E
    Grant the App Service plan hosting the web app a Key Vault access policy with Secret Get permissions on kv-prod.

Answer

Grant the user-assigned managed identity the required Secret Get permissions on the Key Vault, and set the keyVaultReferenceIdentity configuration property of the web app to the resource ID of that user-assigned managed identity.
To retrieve Key Vault secrets using a user-assigned managed identity in Azure App Service Key Vault references, you must perform two main steps. First, the user-assigned managed identity must have permissions to read secrets from the Key Vault (accomplished by granting it Secret Get permissions or the Key Vault Secrets User role). Second, because App Service defaults to the system-assigned identity, you must configure the web app's keyVaultReferenceIdentity property to use the resource ID of the user-assigned managed identity.

Step-by-Step Solution

1
Configure the Key Vault access policy or Azure RBAC role assignment.
The user-assigned managed identity id-inventory is granted Secret Get permissions on kv-prod.
This allows the managed identity to read the secret value from the Key Vault.
2
Associate the user-assigned managed identity with the App Service web app and set the reference identity.
The web app is configured to use id-inventory for Key Vault references by setting keyVaultReferenceIdentity to the identity's resource ID.
By default, Key Vault references use the system-assigned identity. Specifying keyVaultReferenceIdentity is required to route Key Vault reference retrieval through the user-assigned identity.
3
Create the app setting referencing the Key Vault secret.
The application setting is configured with the correct Key Vault reference syntax.
This enables App Service to resolve the environment variable to the Key Vault secret value at runtime.

Key Concept

Configuring Key Vault references in Azure App Service with user-assigned managed identities.
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic