Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are developing an ASP.NET Core web application hosted on Azure App Service that retrieves database connection strings from Azure Key Vault. The application uses the DefaultAzureCredential class from the Azure.Identity library to authenticate. To meet security requirements, the managed identity must be exclusive to this App Service instance, and its lifecycle must be bound directly to the App Service. You run the command 'az webapp identity assign --name MyWebApp --resource-group MyResourceGroup' to configure the App Service. However, when the web application starts up and attempts to retrieve a secret, a credential retrieval error occurs. Which of the following actions should you perform to resolve this issue?

  1. Assign the Key Vault Secrets User role to the App Service's system-assigned managed identity at the Key Vault scope.Answer
  2. B
    Assign the Reader role to the App Service's system-assigned managed identity at the Key Vault resource group scope.
  3. C
    Create a new user-assigned managed identity, assign it the Key Vault Secrets User role, and associate it with the App Service.
  4. D
    Modify the web application code to pass a Client ID to the DefaultAzureCredential constructor.

Answer

Assign the Key Vault Secrets User role to the App Service's system-assigned managed identity at the Key Vault scope.
The correct action is to assign the Key Vault Secrets User role to the App Service's system-assigned managed identity at the Key Vault scope. Running the Azure CLI command enables the system-assigned managed identity on the App Service. However, to access the Key Vault secrets, the identity must be explicitly authorized. The Key Vault Secrets User role provides the necessary data-plane permissions for reading secrets. Using a system-assigned identity satisfies the requirement that the identity's lifecycle is bound directly to the resource.

Step-by-Step Solution

1
Analyze the identity requirements
The requirement states that the identity must be exclusive and its lifecycle bound directly to the App Service, which specifies a system-assigned managed identity.
This helps identify if the command run ('az webapp identity assign') correctly enabled the system-assigned managed identity, which it did.
2
Diagnose the error cause
The identity exists on the App Service but cannot read secrets from the Key Vault, indicating a missing data-plane permission (RBAC role or Key Vault access policy).
Enabling the identity on the host resource only registers it in Microsoft Entra ID; it does not grant permissions to other Azure resources automatically.
3
Determine the correct authorization level
Assign the Key Vault Secrets User role (or equivalent access policy) to the system-assigned managed identity at the Key Vault scope.
This grants the application permission to read secrets (data-plane access) while keeping the lifecycle bound to the App Service.

Key Concept

Authorizing a system-assigned managed identity to access Azure Key Vault secrets using Role-Based Access Control (RBAC).
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic