Examkin

Question

Difficulty: HardMicrosoft Identity Platform Authentication

You are developing a backend service in C# using MSAL.NET that runs on an Azure App Service. The App Service has a user-assigned managed identity configured with the Client ID `d29d3368-8f83-4a25-97a1-872f23cf9e3c`. The service must securely access an Azure Key Vault without storing any secrets or certificates in the application configuration. Which two configuration steps should you implement in the C# code? (Select two.)

  1. Initialize the managed identity application by calling `ManagedIdentityApplicationBuilder.Create(ManagedIdentityId.WithUserAssignedClientId("d29d3368-8f83-4a25-97a1-872f23cf9e3c")).Build()`Answer
  2. Acquire the token by calling `app.AcquireTokenForManagedIdentity("https://vault.azure.net/.default").ExecuteAsync()` on the initialized application instanceAnswer
  3. C
    Initialize the managed identity application by calling `ManagedIdentityApplicationBuilder.Create(ManagedIdentityId.SystemAssigned).Build()`
  4. D
    Acquire the token by calling `app.AcquireTokenForClient(new[] { "https://vault.azure.net/.default" }).ExecuteAsync()` on the application instance
  5. E
    Initialize the managed identity application by calling `ManagedIdentityApplicationBuilder.Create(ManagedIdentityId.WithUserAssignedResourceId("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myId")).Build()`

Answer

Initialize the managed identity application by calling ManagedIdentityApplicationBuilder.Create(ManagedIdentityId.WithUserAssignedClientId("d29d3368-8f83-4a25-97a1-872f23cf9e3c")).Build(), and acquire the token by calling app.AcquireTokenForManagedIdentity("https://vault.azure.net/.default").ExecuteAsync() on the initialized application instance.
To authenticate using a user-assigned managed identity via MSAL.NET, you must initialize the application using ManagedIdentityApplicationBuilder with ManagedIdentityId.WithUserAssignedClientId to specify the client ID. Once configured, you must call AcquireTokenForManagedIdentity on the application instance to acquire a token for the Azure Key Vault resource scope.

Step-by-Step Solution

1
Determine the identity type and configure the application builder
Identify that the application uses a user-assigned managed identity requiring its Client ID. Initialize the application using ManagedIdentityApplicationBuilder.Create(ManagedIdentityId.WithUserAssignedClientId(...)).Build().
ManagedIdentityApplicationBuilder is the specific class in MSAL.NET designed to acquire tokens for managed identities without client secrets or certificates.
2
Request the access token for the target Azure service
Call the AcquireTokenForManagedIdentity method on the initialized application instance, passing the default scope for Azure Key Vault (https://vault.azure.net/.default), and execute it asynchronously.
AcquireTokenForManagedIdentity is the correct MSAL.NET method for retrieving tokens from the local managed identity endpoint for a given resource.

Key Concept

Configuring MSAL.NET to acquire tokens using a user-assigned managed identity with its Client ID.
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic