You are deploying a web application to Azure App Service using an Azure Resource Manager (ARM) template. The application must retrieve database connection strings from Azure Key Vault. Security requirements specify that the managed identity used by the application must be decoupled from the App Service's lifecycle so it can be shared with an Azure Function in the future, and it must not be deleted if the App Service is removed. Which two of the following configuration steps must you perform to implement this security architecture? (Select TWO.)
- Set the identity property type to UserAssigned in the App Service ARM template, and define the identity under the userAssignedIdentities dictionary.Answer
- Run the az role assignment create Azure CLI command to assign the 'Key Vault Secrets User' role to the principal ID of the user-assigned identity at the Key Vault scope.Answer
- CSet the identity property type to SystemAssigned in the App Service ARM template to ensure Azure automatically handles the token sharing and identity persistence.
- DGrant access to the App Service web app by creating a Key Vault access policy that uses the default App Service Application Registration, bypassing the need for a managed identity.
Answer
To implement this architecture, you must set the identity type to UserAssigned in the App Service resource definition and use Azure CLI to assign the Key Vault Secrets User role to the identity's principal ID.
Configuring a user-assigned managed identity allows the security context to exist independently of the App Service resource, which is required for sharing with the Azure Function and surviving deletion of the App Service. Assigning the Key Vault Secrets User role to the identity's principal ID grants the required permissions without managing secrets.
Step-by-Step Solution
Key Concept
Selecting and configuring the correct type of managed identity based on resource sharing and lifecycle requirements.
Estimated Time:1m 30s