An enterprise application requires an Azure Function App to retrieve its database connection strings securely from Azure Key Vault without storing credentials in the application configuration. According to your organization's security policy, you must use a user-assigned managed identity instead of a system-assigned managed identity to access the key vault.
Which four actions should you perform in sequence to configure the Function App? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
- 1Create a user-assigned managed identity and assign it to the Function App.
- 2Grant the user-assigned managed identity Secret Get permission on the Azure Key Vault.
- 3Configure the Function App setting keyVaultReferenceIdentity with the resource ID of the user-assigned managed identity.
- 4Add a new application setting to the Function App with its value formatted as a Key Vault reference.
Answer
To configure the Function App to use a user-assigned managed identity for Key Vault references, you first create the identity and assign it to the Function App. Next, grant the identity Secret Get permission on the Key Vault. Then, set the keyVaultReferenceIdentity app setting to the resource ID of the identity. Finally, add the application setting referencing the secret.
The correct sequence ensures that the user-assigned managed identity is established first, granted permissions to the Key Vault next, mapped as the identity provider for Key Vault references in the application configuration using its full resource ID, and then utilized in the app setting references.
Step-by-Step Solution
Key Concept
Configuring Key Vault references in Azure Functions with user-assigned managed identities.