Examkin

Question

Difficulty: Very hardCreate and Configure Azure Functions

You are configuring an Azure Function App (Runtime version 4.x) to securely retrieve database credentials from Azure Key Vault. Security guidelines require the following constraints:
- You must use a user-assigned managed identity.
- You must not enable or use a system-assigned managed identity.
- The Azure Functions hosting platform must natively resolve the secrets without custom code.
- The configuration must follow the principle of least privilege, ensuring no intermediate state exposes unresolved secrets to the application runtime or results in service resolution failures.

In which order should you execute the configuration steps to successfully enable the Function App to resolve the Key Vault secrets?

  1. 1Create a user-assigned managed identity in Microsoft Entra ID.
  2. 2Assign the user-assigned managed identity to the identity configuration of the Azure Function App.
  3. 3Assign the Key Vault Secrets User role to the user-assigned managed identity on the target Azure Key Vault.
  4. 4Configure the keyVaultReferenceIdentity property of the Function App to the resource ID of the user-assigned managed identity.
  5. 5Add an application setting to the Function App referencing the secret URI using the @Microsoft.KeyVault syntax.

Answer

The correct sequence is: first create the user-assigned managed identity, associate it with the Function App, grant it the Key Vault Secrets User role on the Key Vault, configure the keyVaultReferenceIdentity property of the Function App to use this identity, and finally add the application setting using the Key Vault reference syntax.
To resolve Key Vault references using a user-assigned managed identity, the identity must first exist. It then must be associated with the Function App. Granting Key Vault Secrets User permissions ensures that the identity can retrieve the secret. The keyVaultReferenceIdentity property must be configured to point to this identity before the application setting is created. If the application setting is added first, the platform will attempt to resolve the reference using either the system-assigned identity (which is disabled) or will fail to resolve because it does not know which user-assigned identity to use.

Step-by-Step Solution

1
Create the user-assigned managed identity.
A new user-assigned managed identity is provisioned in Microsoft Entra ID.
An identity must exist in Microsoft Entra ID before it can be assigned permissions or associated with any Azure resources.
2
Associate the user-assigned managed identity with the Function App.
The Function App's identity block is updated to include the user-assigned managed identity.
The identity must be associated with the Function App resource so that Azure's hosting platform recognizes it as a valid identity for the app.
3
Grant the user-assigned managed identity the 'Key Vault Secrets User' role on the Key Vault.
An RBAC role assignment is created, allowing the identity to read secrets from the Key Vault.
By default, identities have no permissions to access Key Vault secrets. This step ensures the identity has the necessary read access.
4
Set the 'keyVaultReferenceIdentity' property on the Function App to the resource ID of the user-assigned identity.
The Function App site configuration is updated to designate this specific identity for resolving Key Vault references.
By default, Azure Functions attempts to resolve Key Vault references using the system-assigned identity. Since only a user-assigned identity is used here, the platform must be explicitly told which identity to use.
5
Add the application setting using the @Microsoft.KeyVault(SecretUri=...) syntax.
The application setting is added, and the Azure Functions runtime resolves the secret value at startup.
Once all security, identity, and routing configurations are in place, the application setting can be safely added to trigger resolution without errors.

Key Concept

Configuring Azure Functions to retrieve app settings securely using User-Assigned Managed Identity and Key Vault References.
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic