Examkin

Question

Difficulty: Very hardSystem-Assigned and User-Assigned Managed Identities

You are designing the security architecture for a C# web application deployed to two distinct Azure App Service instances in different regions (East US and West US) to support active-active high availability. Both App Service instances must retrieve database connection strings from a shared Azure Key Vault and connect to a shared Azure SQL Database without storing credentials in code or configuration files.

The design must satisfy the following security and operational constraints:
- Minimize administrative overhead by avoiding the creation of separate database users and Key Vault access policies/RBAC roles for each regional App Service instance.
- Ensure that if one of the App Service instances is deleted, the identity used to authenticate to the Key Vault and Azure SQL Database remains intact and functional for the remaining instance.
- The application code must use the C# Azure.Identity SDK and instantiate DefaultAzureCredential to authenticate to both services.

Which configuration and code setup should you implement to meet these requirements?

  1. A
    Create a system-assigned managed identity for each App Service instance by setting the identity.type property to SystemAssigned in the ARM templates. Grant each identity Key Vault and Azure SQL Database access. If one App Service instance is deleted, use the Azure CLI command az identity restore to recover the deleted security principal.
  2. Create one user-assigned managed identity. In the App Service ARM templates, set the identity.type property to UserAssigned and configure the identity's resource ID in the userAssignedIdentities property. Configure the AZURE_CLIENT_ID application setting on both App Services with the client ID of the user-assigned managed identity, and instantiate DefaultAzureCredential in C# code.Answer
  3. C
    Create one user-assigned managed identity and assign it to both App Service instances. In the C# application code, instantiate DefaultAzureCredential without setting any configuration parameters or environment variables, allowing the SDK to automatically discover the assigned identity.
  4. D
    Create a single user-assigned managed identity. In the App Service ARM templates, set the identity.type property to SystemAssigned and reference the user-assigned identity's principal ID. Grant the Key Vault access policies to the general Azure App Service resource provider service principal.

Answer

Create one user-assigned managed identity, configure the App Service ARM templates to use the UserAssigned identity type mapping the resource ID, set the AZURE_CLIENT_ID environment variable on the App Services, and instantiate DefaultAzureCredential in C# code.
The correct option configures a user-assigned managed identity, which operates independently of individual App Service lifecycles and can be shared across regions to minimize permissions management overhead. It correctly sets the identity type to UserAssigned in ARM and configures the AZURE_CLIENT_ID environment variable, which enables DefaultAzureCredential to resolve the identity successfully at runtime.

Step-by-Step Solution

1
Analyze the identity lifecycle and sharing requirements.
A user-assigned managed identity (UAMI) is chosen because it exists as an independent Azure resource and can be assigned to multiple App Service instances, avoiding duplicated database users and policies.
System-assigned identities are tied to a single resource's lifecycle and cannot be shared across multiple resources.
2
Determine the correct ARM template configuration.
Set the identity.type property to UserAssigned and reference the identity's resource ID within the userAssignedIdentities property block.
Setting the type to SystemAssigned or using the principal ID in the configuration block is invalid configuration syntax for user-assigned identities.
3
Configure the App Service environment and C# code.
Add the AZURE_CLIENT_ID application setting containing the client ID of the user-assigned identity to both App Services, and initialize DefaultAzureCredential in C#.
Without the client ID specified via the AZURE_CLIENT_ID environment variable, DefaultAzureCredential will not be able to identify which user-assigned identity to use when requesting tokens.

Key Concept

Selecting and configuring user-assigned managed identities for multi-resource sharing, independent lifecycles, and resolution with DefaultAzureCredential.
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic