Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are designing a deployment architecture for a set of five independent Azure App Service web apps. Each web app must access a shared Azure Key Vault to retrieve common application settings. Each web app is managed and scaled independently, and some may be deleted or recreated during routine updates. You need to configure a managed identity solution that minimizes administrative overhead for granting Key Vault permissions and ensures that the identity credentials persist even if individual web apps are deleted.

Which managed identity configuration should you implement to meet these requirements?

  1. A single user-assigned managed identity assigned to all five App Services, with that identity granted the necessary access permissions on the Key Vault.Answer
  2. B
    A system-assigned managed identity enabled on each App Service, with each individual identity granted the necessary access permissions on the Key Vault.
  3. C
    A single system-assigned managed identity configured at the App Service Plan level, allowing all App Services within the plan to inherit the identity.
  4. D
    A single user-assigned managed identity assigned to all five App Services, relying on default Key Vault settings that automatically authorize any identity created in the same Microsoft Entra tenant.

Answer

A single user-assigned managed identity assigned to all five App Services, with that identity granted the necessary access permissions on the Key Vault.
Using a single user-assigned managed identity is the optimal choice because it exists as a standalone Azure resource. It can be shared across multiple Azure App Services, allowing you to configure a single access control rule (RBAC role or Key Vault access policy) on the Key Vault. Additionally, its lifecycle is independent of the App Services; deleting or recreating the web apps does not delete the user-assigned identity, avoiding the need to reconfigure Key Vault permissions.

Step-by-Step Solution

1
Analyze resource sharing and lifecycle requirements.
The identity must support sharing across five App Services to minimize administrative overhead and survive the deletion and recreation of the individual App Service instances.
Identifying these parameters determines whether a system-assigned or user-assigned identity is appropriate.
2
Compare managed identity lifecycles and sharing features.
User-assigned managed identities are standalone resources that can be shared, while system-assigned identities are tied 1-to-1 to a single resource instance's lifecycle.
Selecting a user-assigned managed identity satisfies the independent lifecycle and cross-resource sharing requirements.
3
Determine the required access policy configuration.
Grant Key Vault access explicitly to the selected user-assigned managed identity.
Security credentials provided by managed identities do not have access by default, and access must be explicitly granted on the target resource.

Key Concept

Architectural and lifecycle differences between system-assigned and user-assigned managed identities.
Estimated Time:1m 30s
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic