Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

Your team is configuring a distributed C# application hosted on an Azure Virtual Machine Scale Set (VMSS) to access an Azure Storage account. Multiple VMSS instances will be scaled out and in dynamically. The identity used for accessing the storage account must persist independently of the VMSS lifecycle.

Which two configurations are required to ensure the application can successfully authenticate and read blobs from the storage account using the Azure.Identity library? (Select two.)

  1. Assign the Storage Blob Data Reader role to the user-assigned managed identity at the storage account resource scope.Answer
  2. B
    Configure a system-assigned managed identity on the Virtual Machine Scale Set and grant it the Storage Blob Data Reader role.
  3. Instantiate the DefaultAzureCredential class by passing a DefaultAzureCredentialOptions instance with the ManagedIdentityClientId property set to the client ID of the user-assigned managed identity.Answer
  4. D
    Instantiate the DefaultAzureCredential class by configuring the AZURE_CLIENT_ID environment variable to match the object ID (principal ID) of the user-assigned managed identity.

Answer

To implement this solution, you must assign the Storage Blob Data Reader role to the user-assigned managed identity at the storage account scope, and instantiate the DefaultAzureCredential class by passing a DefaultAzureCredentialOptions instance with the ManagedIdentityClientId property set to the client ID of the user-assigned managed identity.
To ensure the managed identity persists independently of the Virtual Machine Scale Set lifecycle, a user-assigned managed identity must be used instead of a system-assigned one. The user-assigned identity must be granted appropriate access permissions, such as the Storage Blob Data Reader role at the storage account scope. When using DefaultAzureCredential with a user-assigned identity in code, the identity's client ID must be specified (for example, via DefaultAzureCredentialOptions) so that the credential knows which identity to use for token acquisition.

Step-by-Step Solution

1
Select the correct identity type based on the lifecycle requirements.
A user-assigned managed identity is chosen because it exists as a standalone Azure resource and persists independently of the VMSS lifecycle.
System-assigned identities are deleted when the VMSS is deleted, which would violate the persistence requirement.
2
Assign the appropriate RBAC permissions.
The user-assigned identity is assigned the 'Storage Blob Data Reader' role at the storage account scope.
This grants the identity permission to read blob data from the storage account.
3
Configure the application credential usage in code.
The application code instantiates DefaultAzureCredential by explicitly setting the ManagedIdentityClientId property to the Client ID of the user-assigned identity.
Providing the Client ID is required so that DefaultAzureCredential can identify and use the correct user-assigned identity for token acquisition.

Key Concept

Selecting and configuring user-assigned managed identities for applications with dynamic lifecycles using the Azure SDK.
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic