Examkin

Question

Difficulty: HardSystem-Assigned and User-Assigned Managed Identities

You are authoring a Bicep template to deploy an Azure App Service web app that requires access to a shared Azure Key Vault. The web app must use a user-assigned managed identity named `app-identity` that is defined in the same template.

You declare the user-assigned managed identity resource as follows:

bicep
resource appIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
name: 'app-identity'
location: location
}

You need to define the `identity` property of the App Service web app resource to assign this managed identity.

Which Bicep block should you include in the App Service resource definition?

  1. A
    identity: {
    type: 'UserAssigned'
    userAssignedIdentities: [
    appIdentity.id
    ]
    }
  2. B
    identity: {
    type: 'UserAssigned'
    name: 'app-identity'
    }
  3. identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
    '${appIdentity.id}': {}
    }
    }    Answer
  4. D
    identity: {
    type: 'UserAssigned'
    identityId: appIdentity.id
    }

Answer

The correct Bicep block must set the identity type to 'UserAssigned' and define the userAssignedIdentities property as a dictionary with the managed identity's resource ID as the key and an empty object as the value.
The correct Bicep block sets the type to 'UserAssigned' and maps the resource ID of the identity as a key in the userAssignedIdentities object with an empty object value. In ARM/Bicep, the user-assigned identities are represented as a dictionary/object to allow assigning multiple identities, where each key is the unique resource ID of an identity.

Step-by-Step Solution

1
Analyze the resource definition requirements for assigning a user-assigned managed identity in Bicep/ARM.
The identity property requires setting the type property and specifying the identity resource(s).
This establishes the identity configuration schema used by the Azure Resource Manager.
2
Determine the correct value for the type property.
The type property must be set to 'UserAssigned'.
This tells Azure to associate one or more user-assigned managed identities rather than a system-assigned identity.
3
Specify the user-assigned identity using its resource ID.
Use the userAssignedIdentities property, structured as a dictionary (object) where the keys are the resource IDs (e.g., appIdentity.id) and the values are empty objects.
The ARM API expects a JSON object map to support multiple user-assigned identities, rather than a string array or a single property name.

Key Concept

Configuring user-assigned managed identities in Bicep/ARM templates
Estimated Time:1m 30s
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic