Examkin

Question

Difficulty: MediumDefine API Management Policies

You are configuring an Azure API Management (APIM) instance to authenticate to a backend API. The backend API is secured with Microsoft Entra ID and requires an authentication token. You configure the APIM instance to use a system-assigned managed identity.

You need to add a policy that obtains an OAuth token for the resource `https://graph.microsoft.com` and presents it to the backend API.

Which XML policy configuration should you apply?

  1. A
    <outbound>
    <base />
    <authentication-managed-identity resource="https://graph.microsoft.com" />
    </outbound>
  2. <inbound>
    <base />
    <authentication-managed-identity resource="https://graph.microsoft.com" />
    </inbound>    Answer
  3. C
    Configure a user-assigned managed identity in the API Management instance settings, and apply the following policy:

    <inbound>
    <base />
    <authentication-managed-identity resource="https://graph.microsoft.com" />
    </inbound>

    without specifying the client ID or object ID of the user-assigned identity in the policy.
  4. D
    Create an API Management Named Value referencing an Azure Key Vault secret that contains a client secret, and retrieve it using:

    <inbound>
    <base />
    <set-header name="Authorization" exists-action="override">
    <value>{{keyvault-secret-named-value}}</value>
    </set-header>
    </inbound>

    without granting the API Management system-assigned managed identity Get secret permissions in the Key Vault access policies.

Answer

The correct configuration is the inbound policy block containing the authentication-managed-identity element with the resource attribute set to the Microsoft Graph audience.
The correct configuration uses the `<authentication-managed-identity>` policy placed within the `<inbound>` section. This policy instructs Azure API Management to use its system-assigned managed identity to acquire an OAuth token for the specified resource (in this case, `https://graph.microsoft.com`) and add it as an Authorization header to the request before forwarding it to the backend API.

Step-by-Step Solution

1
Determine the correct policy section for modifying the request before forwarding it to the backend.
The modification must happen in the inbound policy section.
Policies in the inbound section run before the request is sent to the backend, which is required for inserting authorization headers.
2
Select the policy designed for managed identity token retrieval.
Use the <authentication-managed-identity> policy with the resource parameter set to the backend app's audience URI.
This policy natively handles token acquisition and attaches the token to the outgoing request's Authorization header automatically.
3
Verify configuration parameters for the system-assigned managed identity.
Ensure no user-assigned identifiers (like client-id) are specified in the policy.
Omitting the client ID correctly defaults the authentication request to the system-assigned identity.

Key Concept

Acquiring an OAuth token for backend authentication using the APIM system-assigned managed identity via the authentication-managed-identity policy in the inbound section.
Rate this question

Topics

Define API Management Policies

More questions from this topic