Examkin

Question

Difficulty: MediumDefine API Management Policies

You are configuring an Azure API Management (APIM) policy to authenticate requests to a secure backend service. The backend service requires Azure Active Directory (Azure AD) tokens for the resource `https://api.contoso.com`. You must use a user-assigned managed identity with the Client ID `11111111−2222−3333−4444−55555555555511111111-2222-3333-4444-555555555555` to authenticate the requests.

Which of the following XML configurations correctly implements this authentication?

  1. A
    <outbound>
    <base />
    <authentication-managed-identity resource="https://api.contoso.com" client-id="11111111-2222-3333-4444-555555555555" />
    </outbound>
  2. <inbound>
    <base />
    <authentication-managed-identity resource="https://api.contoso.com" client-id="11111111-2222-3333-4444-555555555555" />
    </inbound>    Answer
  3. C
    <inbound>
    <base />
    <authentication-managed-identity resource="https://api.contoso.com" />
    </inbound>
  4. D
    <inbound>
    <base />
    <authentication-managed-identity resource="https://api.contoso.com" client-id="{{kv-identity-client-id}}" />
    </inbound>

Answer

The policy configuration that places the authentication-managed-identity element inside the inbound section and includes the correct resource and client-id attributes is correct.
The correct configuration uses the authentication-managed-identity policy within the inbound section, specifying the target resource and the client-id of the user-assigned managed identity. This ensures API Management acquires the Azure AD token using the correct identity and attaches it to the inbound request before it is sent to the backend.

Step-by-Step Solution

1
Determine the correct policy section for backend authentication.
Identify that the authentication policy must be placed in the inbound section so that it executes before the request is dispatched to the backend service.
Placing the policy in the outbound section runs after the backend response has already been received, resulting in unauthenticated requests.
2
Specify the user-assigned managed identity configuration.
Include the client-id attribute with the target GUID value to ensure the policy uses the user-assigned managed identity instead of defaulting to the system-assigned managed identity.
Omitting the client-id attribute tells API Management to look for a system-assigned identity, which may not be enabled or permissioned.
3
Configure the target resource audience.
Set the resource attribute to the backend's App Registration URI or App ID URI.
The resource parameter defines the audience for the acquired Azure AD token.

Key Concept

Azure API Management Managed Identity Authentication Policies
Estimated Time:1m 30s
Rate this question

Topics

Define API Management Policies

More questions from this topic