Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are developing a C# application that runs on an Azure Virtual Machine (VM). The application uses the Azure.Identity library to authenticate to an Azure Key Vault using DefaultAzureCredential. Both a system-assigned managed identity and a user-assigned managed identity are enabled on the VM. The user-assigned managed identity is granted the Key Vault Secrets User role on the Key Vault, but the system-assigned managed identity has no permissions. When the application runs, it fails to retrieve secrets because DefaultAzureCredential attempts to authenticate using the system-assigned managed identity. You need to configure the environment so that DefaultAzureCredential uses the user-assigned managed identity without modifying the code that instantiates DefaultAzureCredential. Which of the following actions should you perform?

  1. Set the AZURE_CLIENT_ID environment variable on the Virtual Machine to the Client ID of the user-assigned managed identity.Answer
  2. B
    Set the AZURE_CLIENT_ID environment variable on the Virtual Machine to the Resource ID of the user-assigned managed identity.
  3. C
    Set the AZURE_TENANT_ID environment variable on the Virtual Machine to the Principal ID of the user-assigned managed identity.
  4. D
    Create an Azure Key Vault access policy that grants the Get secret permission to the VM's system-assigned managed identity.

Answer

Set the AZURE_CLIENT_ID environment variable on the Virtual Machine to the Client ID of the user-assigned managed identity.
When multiple managed identities are configured on a resource, DefaultAzureCredential defaults to the system-assigned managed identity. To override this behavior and select a specific user-assigned managed identity without code changes, you must set the AZURE_CLIENT_ID environment variable to the Client ID of the user-assigned managed identity.

Step-by-Step Solution

1
Identify the authentication behavior of DefaultAzureCredential when both system-assigned and user-assigned managed identities are present.
By default, DefaultAzureCredential will attempt to use the system-assigned managed identity first.
DefaultAzureCredential follows a specific sequence of credential providers, and for managed identities, it defaults to the system-assigned identity unless instructed otherwise.
2
Determine how to configure DefaultAzureCredential to select a specific user-assigned managed identity without code changes.
Identify that the AZURE_CLIENT_ID environment variable can be set to specify the Client ID of the desired user-assigned managed identity.
The Azure Identity SDK checks for the AZURE_CLIENT_ID environment variable to resolve the identity client ID when initializing the ManagedIdentityCredential component of DefaultAzureCredential.
3
Select the correct environment variable value.
The value must be the Client ID (also known as Application ID) of the user-assigned managed identity, not its Resource ID or Principal ID.
Using the Resource ID, Tenant ID, or Principal ID will fail because the SDK expects the Client ID representation to uniquely query the token endpoint for that specific identity.

Key Concept

Configuring DefaultAzureCredential for user-assigned managed identity using environment variables
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic