Examkin

Question

Difficulty: EasySecure App Configuration and Key Vault References

You need to configure an Azure App Service web app to retrieve configuration settings from an Azure App Configuration store. The solution must use a user-assigned managed identity.

Which sequence of actions should you perform? Arrange the actions in the correct order from first to last.

  1. 1Create a user-assigned managed identity in Azure.
  2. 2Assign the App Configuration Data Reader role to the user-assigned managed identity for the Azure App Configuration store.
  3. 3Configure the Azure App Service web app to use the user-assigned managed identity.
  4. 4Add the Azure App Configuration store endpoint URI to the App Service web app's application settings.

Answer

The correct sequence is: Create the user-assigned managed identity; grant the identity the App Configuration Data Reader role on the configuration store; configure the App Service to use the identity; and add the configuration store's endpoint URI to the App Service settings.
To secure App Configuration access using a user-assigned managed identity, you must first create the identity. Next, you assign the necessary RBAC permissions (App Configuration Data Reader role) to the identity. After permissions are set, you link the identity to the App Service web app. Lastly, you define the App Configuration endpoint inside the App Service settings so that the app code knows where to fetch settings using the assigned identity.

Step-by-Step Solution

1
Create a user-assigned managed identity.
A standalone security principal is created.
You need a security principal to grant permissions to and associate with the App Service.
2
Assign the App Configuration Data Reader role to the identity on the App Configuration store.
The identity receives read access to the configuration store.
This establishes access control permissions for the identity.
3
Associate the identity with the App Service web app.
The App Service is configured to use the identity for outbound calls.
The web app must have the identity linked to authenticate requests under it.
4
Add the App Configuration store endpoint to the App Service application settings.
The web app is configured with the target configuration store URI.
The application code needs this endpoint configuration to locate and fetch settings from the store.

Key Concept

Configuring access to Azure App Configuration using a user-assigned managed identity
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic