Examkin

Question

Difficulty: HardCreate and Configure Azure Functions

You are deploying a containerized Azure Function App using a custom Linux Docker image stored in a private Azure Container Registry (ACR).

You must configure the Function App to pull the container image from the ACR using a system-assigned managed identity instead of admin credentials.

Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

  1. 1Build the Function App container image and push it to the Azure Container Registry (ACR).
  2. 2Create a Linux-based Function App in an Elastic Premium plan configured for custom containers.
  3. 3Enable the system-assigned managed identity for the Function App.
  4. 4Assign the AcrPull role to the Function App's system-assigned managed identity at the ACR resource scope.
  5. 5Add an application setting named ACR_USE_MANAGED_IDENTITY_CREDENTIALS to the Function App and set its value to true.

Answer

The correct order of actions is: 1) Build and push the container image to the Azure Container Registry; 2) Create the Linux-based Function App in a plan that supports containers; 3) Enable the system-assigned managed identity on the Function App; 4) Assign the AcrPull role to the managed identity at the registry scope; 5) Configure the ACR_USE_MANAGED_IDENTITY_CREDENTIALS application setting to true.
To secure the deployment of a custom container image from a private Azure Container Registry (ACR) to an Azure Function App, you must first build and push the container image to ACR. Next, create the Function App on an Elastic Premium or Dedicated hosting plan, as Consumption plans do not support custom container deployments. Once the app is created, enable the system-assigned managed identity. With the identity active, you can then assign it the 'AcrPull' role at the registry scope. Finally, configure the Function App settings to use the managed identity credentials by setting the ACR_USE_MANAGED_IDENTITY_CREDENTIALS app setting to true.

Step-by-Step Solution

1
Build the Function App container image and push it to the Azure Container Registry (ACR).
The Docker image containing the Azure Function code and runtime dependencies is stored in the private registry.
The image must be present in the registry before it can be referenced during the Function App creation and deployment process.
2
Create a Linux-based Function App in an Elastic Premium plan configured for custom containers.
A Function App hosting resource is provisioned in Azure.
Custom container deployment for Azure Functions requires a Premium or Dedicated App Service plan (Consumption plans do not support custom container deployments).
3
Enable the system-assigned managed identity for the Function App.
A service principal is registered in Microsoft Entra ID representing the Function App.
You must generate the identity first before assigning Azure RBAC roles to it.
4
Assign the AcrPull role to the Function App's system-assigned managed identity at the ACR resource scope.
The Function App's identity is authorized to pull container images from the ACR.
Secure access without storing secrets is achieved by assigning the appropriate Azure RBAC role (AcrPull) to the Function App's identity.
5
Add an application setting named ACR_USE_MANAGED_IDENTITY_CREDENTIALS to the Function App and set its value to true.
The Function App's container runtime is configured to authenticate against the registry using the managed identity.
Setting ACR_USE_MANAGED_IDENTITY_CREDENTIALS to true instructs the platform to bypass admin credentials and pull using the managed identity.

Key Concept

Deploying containerized Azure Functions using managed identity for Azure Container Registry authentication
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic