Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

An organization is deploying three separate Azure Function apps that all retrieve configuration secrets from a shared Azure Key Vault and query data from a shared Azure SQL Database. You need to configure managed identities for the application authentication. The solution must minimize administrative overhead for managing access control and ensure that deleting any individual Function app does not affect the permissions or credentials of the remaining apps. Which two actions should you perform? (Choose two.)

  1. Create a single user-assigned managed identity and configure all three Azure Function apps to use this identity.Answer
  2. Grant the user-assigned managed identity the Key Vault Secrets User role on the Azure Key Vault and the db_datareader role on the Azure SQL Database.Answer
  3. C
    Enable a system-assigned managed identity on each of the three Azure Function apps.
  4. D
    Create a single system-assigned managed identity at the resource group level to represent all three Function apps.
  5. E
    Assign the Reader RBAC role at the Key Vault resource group level to the managed identity.

Answer

Create a single user-assigned managed identity and configure all three Azure Function apps to use this identity, and grant the user-assigned managed identity the Key Vault Secrets User role on the Azure Key Vault and the db_datareader role on the Azure SQL Database.
The correct options are to create a single user-assigned managed identity and assign it to all three apps, and to grant it the Key Vault Secrets User and db_datareader roles. A user-assigned managed identity is a standalone Azure resource with an independent lifecycle that can be associated with multiple resources. This satisfies the requirement to minimize overhead and prevent accidental credential deletion. To read secrets and SQL database data, the identity needs explicit data plane permissions.

Step-by-Step Solution

1
Analyze the identity sharing and lifecycle requirements.
A user-assigned managed identity is selected because it is created as a standalone Azure resource and can be shared across multiple resources (minimizing permission overhead), and its lifecycle is independent of the individual Function apps.
System-assigned identities are tied to a single resource and cannot be shared, which increases management overhead.
2
Assign the correct data plane permissions to the shared identity.
The identity is granted data-plane roles: Key Vault Secrets User on the Key Vault and db_datareader in the SQL Database.
Management plane roles like Reader at the resource group level do not grant access to the actual secrets contained within the Key Vault.

Key Concept

User-assigned managed identities allow credentials and access control to be shared among multiple resources while maintaining a lifecycle independent of the resources themselves, whereas data-plane access requires specific data-plane roles rather than management-plane Reader roles.
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic