Examkin

Question

Difficulty: MediumApp Registrations and Service Principals

You are developing a local console application that runs on an on-premises developer workstation. The application must periodically upload application diagnostic logs to a specific container in an Azure Storage account. You plan to configure the application to authenticate using a Microsoft Entra ID service principal with a client secret, adhering to the principle of least privilege.

Which sequence of steps should you perform to configure the identity, permissions, and application code?

  1. 1Register the application in Microsoft Entra ID to establish its application object and automatically create its home tenant service principal.
  2. 2Generate a new client secret under the Certificates & secrets configuration of the registered application.
  3. 3Assign the Storage Blob Data Contributor role to the application's service principal at the scope of the target blob container.
  4. 4Configure the console application code to instantiate a ClientSecretCredential using the application ID, tenant ID, and client secret to access the blob container.

Answer

First register the application in Microsoft Entra ID, then generate a new client secret under Certificates & secrets, next assign the Storage Blob Data Contributor role to the service principal at the scope of the storage container, and finally configure the application code to use the ClientSecretCredential.
The correct sequence begins with registering the application in Microsoft Entra ID to create the security principal. Next, a client secret is generated to authenticate this registration. Then, the service principal is granted the Storage Blob Data Contributor role at the container scope to ensure proper authorization. Finally, the developer instantiates a ClientSecretCredential in code to perform authentication.

Step-by-Step Solution

1
Register the application in Microsoft Entra ID.
Creates the application object and its corresponding service principal in the tenant.
You must establish the identity in the directory before you can add credentials or grant permissions to it.
2
Generate a client secret in the Microsoft Entra portal.
Creates a secure secret key associated with the application registration.
The secret key is required for the application to authenticate itself as the service principal.
3
Assign the Storage Blob Data Contributor role to the service principal at the container scope.
Grants the application permission to write blobs in the specific container.
Roles must be assigned to the service principal (not the application object) at the narrowest possible scope to respect the principle of least privilege.
4
Instantiate ClientSecretCredential in code.
Requests an access token from Microsoft Entra ID to authenticate requests to the storage container.
The application code needs the application ID, tenant ID, and client secret to perform token acquisition and execute authorized operations.

Key Concept

App Registrations, Service Principals, and Client Secrets configuration flow
Estimated Time:1m 30s
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic