Examkin

Question

Difficulty: MediumMicrosoft Identity Platform Authentication

You are developing a containerized API that will run on Azure Container Instances. The container groups are frequently created, destroyed, and recreated via automated workflows. The API must authenticate to the Microsoft Identity Platform to retrieve configuration keys from Azure App Configuration. You must ensure that recreating the Container Instances does not require updating permission grants in Azure App Configuration. Which two configurations should you implement? (Select two.)

  1. Create a user-assigned managed identity, assign it to the container group, and grant it the App Configuration Data Reader role.Answer
  2. Instantiate DefaultAzureCredential by passing DefaultAzureCredentialOptions with the ManagedIdentityClientId property set to the client ID of the user-assigned managed identity.Answer
  3. C
    Enable a system-assigned managed identity on the container group and grant it the App Configuration Data Reader role.
  4. D
    Instantiate DefaultAzureCredential by passing DefaultAzureCredentialOptions with the ManagedIdentityClientId property set to the Azure resource ID of the user-assigned managed identity.

Answer

Use a user-assigned managed identity assigned to the container group and configure DefaultAzureCredentialOptions in code using the client ID of that identity.
A user-assigned managed identity operates as a standalone Azure resource, so its lifecycle is decoupled from the container instances. Recreating the container instances will not delete the identity or its assigned roles. When writing the authentication code, DefaultAzureCredential needs to know which user-assigned identity to use, which is achieved by specifying the client ID via DefaultAzureCredentialOptions.ManagedIdentityClientId.

Step-by-Step Solution

1
Analyze the resource lifecycle requirements.
Determine that because the container groups are frequently destroyed and recreated, a system-assigned managed identity is unsuitable as its credentials and role assignments would be deleted along with the resource.
A user-assigned managed identity exists as a standalone Azure resource, meaning its identity and role assignments persist independently of the container lifecycle.
2
Create and associate the identity.
Create a user-assigned managed identity, assign it to the container group, and grant it the App Configuration Data Reader role in the Azure App Configuration resource.
This establishes the identity, links it to the container group, and grants the minimum required access permissions to retrieve configuration data.
3
Configure the Azure SDK client in application code.
Instantiate DefaultAzureCredential passing an instance of DefaultAzureCredentialOptions with the ManagedIdentityClientId property configured to the client ID of the user-assigned managed identity.
Explicitly passing the client ID is necessary because a resource can have multiple user-assigned managed identities, and the SDK needs to know which specific identity to use for token acquisition.

Key Concept

User-assigned managed identity lifecycle and Client ID configuration in Azure SDK / MSAL authentication.
Rate this question

Topics

Microsoft Identity Platform Authentication

More questions from this topic