Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are developing a web application that will be hosted on Azure App Service. The application must retrieve secrets from an Azure Key Vault. You decide to use a user-assigned managed identity for authentication. The application code uses the DefaultAzureCredential class from the Azure.Identity library.

You need to configure the Azure resources and the web application to enable secure access.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  1. 1Create a user-assigned managed identity.
  2. 2Assign the user-assigned managed identity to the App Service web app.
  3. 3Assign the Key Vault Secrets User role to the user-assigned managed identity's service principal.
  4. 4Add the AZURE_CLIENT_ID application setting containing the Client ID of the user-assigned managed identity to the App Service.

Answer

Create a user-assigned managed identity, assign the user-assigned managed identity to the App Service web app, assign the Key Vault Secrets User role to the user-assigned managed identity's service principal, and add the AZURE_CLIENT_ID application setting containing the Client ID of the user-assigned managed identity to the App Service.
To use a user-assigned managed identity with Azure App Service and access Azure Key Vault via the Azure SDK's DefaultAzureCredential, you must first create the identity as an independent Azure resource. Then, you associate the identity with the App Service web app so the hosting environment is aware of it. Next, you assign the necessary RBAC role (Key Vault Secrets User) to the identity's principal ID on the Key Vault. Finally, you set the AZURE_CLIENT_ID application setting on the web app to specify the Client ID of the user-assigned managed identity, which ensures that DefaultAzureCredential selects the correct user-assigned identity for token requests.

Step-by-Step Solution

1
Create a user-assigned managed identity.
A standalone identity resource is provisioned in Azure with its own Client ID and Principal ID.
The identity must exist in Azure before it can be assigned to the web app or granted permissions.
2
Assign the user-assigned managed identity to the App Service web app.
The App Service web app is associated with the user-assigned managed identity.
This configuration allows the App Service infrastructure to obtain tokens on behalf of the identity.
3
Assign the Key Vault Secrets User role to the user-assigned managed identity's service principal.
The identity's service principal is authorized to retrieve secrets from the Key Vault.
The identity must have appropriate RBAC permissions to access the target resource.
4
Add the AZURE_CLIENT_ID application setting containing the Client ID of the user-assigned managed identity to the App Service.
The environment variable AZURE_CLIENT_ID is set in the App Service execution context.
DefaultAzureCredential uses this environment variable to resolve which user-assigned identity to use when multiple identities or a system identity could be present.

Key Concept

Provisioning and configuring a user-assigned managed identity for Azure App Service and Key Vault
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic