Examkin

Question

Difficulty: EasyProvision and Configure Azure API Management

You provision a new Azure API Management (APIM) instance. You need to configure the APIM instance to authenticate securely to a backend Azure App Service API without storing any credentials, connection strings, or certificates in the APIM configuration. What should you configure first on the API Management instance?

  1. Enable a system-assigned managed identity on the API Management instance.Answer
  2. B
    Enable a system-assigned managed identity on the backend Azure App Service.
  3. C
    Store a client secret credential directly within the outbound section of the API policy.
  4. D
    Generate a Shared Access Signature (SAS) token on the backend App Service.

Answer

Enable a system-assigned managed identity on the API Management instance.
Enabling a system-assigned managed identity on the API Management instance creates a security identity in Microsoft Entra ID for the resource. APIM can then use this identity to obtain Microsoft Entra ID tokens and authenticate to the backend Azure App Service without requiring any credentials to be configured or stored in the policy files or APIM settings.

Step-by-Step Solution

1
Enable a system-assigned managed identity on the API Management (APIM) instance.
Azure creates an identity for the APIM instance in Microsoft Entra ID.
This allows the APIM instance to act as a security principal when authenticating to downstream services.
2
Configure the backend Azure App Service to accept Microsoft Entra ID token-based authentication.
The App Service is configured to require authentication and authorize the APIM identity.
This ensures that only authorized clients (like APIM) can call the backend API.
3
Use the authentication-managed-identity policy in APIM's inbound policy section.
APIM automatically requests a token from Entra ID using its identity and forwards it to the backend.
This dynamically authenticates requests sent to the backend without hardcoding any secrets.

Key Concept

Configuring a system-assigned managed identity on Azure API Management to securely connect to backend services without managing credentials.
Rate this question

Topics

Provision and Configure Azure API Management