Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are configuring an ASP.NET Core web application hosted on an Azure App Service to retrieve data from an Azure SQL Database. The application must authenticate using a user-assigned managed identity. You need to configure the required identity and database access. Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

  1. 1Create a user-assigned managed identity in Microsoft Entra ID.
  2. 2Associate the user-assigned managed identity with the Azure App Service web app.
  3. 3Connect to the Azure SQL Database by using a Microsoft Entra ID administrator account.
  4. 4Run the SQL command to create a database user mapped to the user-assigned managed identity.
  5. 5Run the SQL command to add the database user to the db_datareader role.

Answer

To configure a user-assigned managed identity for an Azure App Service to access Azure SQL Database, the correct sequence of actions is: 1. Create a user-assigned managed identity in Microsoft Entra ID. 2. Associate the user-assigned managed identity with the Azure App Service web app. 3. Connect to the Azure SQL Database by using a Microsoft Entra ID administrator account. 4. Run the SQL command to create a database user mapped to the user-assigned managed identity. 5. Run the SQL command to add the database user to the db_datareader role.
The correct sequence starts with creating the user-assigned managed identity and associating it with the App Service web app. Next, you must connect to the Azure SQL Database using a Microsoft Entra ID administrator account to have the necessary privileges to provision external users. Inside the SQL Database, you run a SQL query to create a user mapped to the managed identity, and finally run another query to add that user to the db_datareader role to grant the application access.

Step-by-Step Solution

1
Create the user-assigned managed identity
The identity exists in Microsoft Entra ID and has a unique client ID and principal ID.
An identity must exist before it can be assigned to resources or referenced in permissions.
2
Associate the user-assigned managed identity with the App Service
The App Service is configured to use the identity for outbound authentications.
This allows the application hosted on the App Service to request access tokens for this identity.
3
Connect to Azure SQL Database using a Microsoft Entra ID administrator
Established database connection with administrative privileges capable of creating Entra-based users.
Standard SQL logins do not have permissions to query Microsoft Entra ID to validate and create database users from external providers.
4
Create a SQL database user mapped to the managed identity
A database user represents the managed identity within the database context.
A database user is required to grant database-level permissions to the identity.
5
Grant the database user the db_datareader role
The database user is added to the role, giving it read access.
This authorizes the identity to read data from the database.

Key Concept

Provisioning, assigning, and authorizing a user-assigned managed identity to access Azure SQL Database
Rate this question