Examkin

Question

Difficulty: EasyCreate and Configure Azure Functions

You are configuring an Azure Function App to retrieve a database connection string from Azure Key Vault using a Key Vault reference in the application settings. Which of the following is a requirement for the reference to resolve successfully?

  1. The Function App's managed identity must be granted GET permissions for secrets in the Key Vault.Answer
  2. B
    The application setting value must use the @Vault(SecretUri=...) prefix syntax.
  3. C
    The Function App must use a user-assigned identity created automatically by the Key Vault.
  4. D
    The Function App must be deployed on a Consumption plan to support Key Vault references.

Answer

The Function App's managed identity must be granted GET permissions for secrets in the Key Vault.
For Key Vault references to resolve successfully, the Function App's managed identity (whether system-assigned or user-assigned) must be granted the GET permission on secrets in the Key Vault. This allows the Azure Functions runtime to retrieve the connection string on behalf of the application.

Step-by-Step Solution

1
Enable a managed identity (either system-assigned or user-assigned) on the Azure Function App.
The Function App obtains an identity registered in Microsoft Entra ID.
An identity is required so that Azure Key Vault can authenticate and authorize the Function App's access request.
2
Create an access policy or Azure RBAC role assignment on the Azure Key Vault that grants the Secret GET permission to the Function App's managed identity.
The Function App's identity is authorized to retrieve secret values from the Key Vault.
Without explicit read authorization, the Key Vault will reject the reference resolution request from the Function App runtime.
3
Configure the application setting in the Function App using the correct reference syntax: @Microsoft.KeyVault(SecretUri=secret_uri) or @Microsoft.KeyVault(VaultName=vault_name;SecretName=secret_name).
The runtime detects the Key Vault reference and fetches the secret during startup or configuration loading.
Using the correct syntax tells the Azure Functions host runtime to intercept the setting and fetch it from Key Vault.

Key Concept

Configuring Azure Functions to securely retrieve secrets using Key Vault references and managed identities.
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic