To secure database credentials, a company's web application running on an Azure App Service web app must load its connection string from a central Azure Key Vault. The developers plan to configure Key Vault references within the app settings.
Which two configuration steps are required to ensure the web app can successfully resolve the references at runtime? (Choose two.)
- Enable a system-assigned managed identity on the web app and grant it Get secrets permission in the Key Vault access policies.Answer
- Set the App Setting value to @Microsoft.KeyVault(SecretUri=https://vault-prod.vault.azure.net/secrets/db-conn/).Answer
- CEnable a system-assigned managed identity on the Key Vault and grant the web app permission to access it.
- DSet the App Setting value to @KeyVault(SecretUri=https://vault-prod.vault.azure.net/secrets/db-conn/).
Answer
To resolve Key Vault references, you must enable a system-assigned managed identity on the web app and grant it Get secrets permission in the Key Vault, and set the App Setting value to use the correct syntax starting with the @Microsoft.KeyVault prefix.
For an App Service web app to resolve Key Vault secrets at runtime, two conditions must be met: the app must have an identity authorized to access the Key Vault, and the app setting must use the valid syntax. Enabling a system-assigned managed identity on the web app and granting it Get secrets permission in Key Vault satisfies the security requirement. Setting the App Setting value to the exact @Microsoft.KeyVault(SecretUri=...) format satisfies the syntactic requirement.
Step-by-Step Solution
Key Concept
Key Vault references in App Service allow an application to use Key Vault secrets in app settings without code changes, requiring a managed identity, proper access permissions, and correct URI syntax.