Examkin

Question

Difficulty: Very hardAzure Key Vault Secret, Key, and Certificate Management

You are deploying an Azure App Service web app that must retrieve a database connection string from an Azure Key Vault using a user-assigned managed identity for compliance reasons. The Key Vault uses Azure Role-Based Access Control (RBAC) for authorization.

The user-assigned managed identity has been assigned the 'Key Vault Secrets User' role on the Key Vault. You use the following Bicep template snippet to deploy the web app:

bicep
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
name: webAppName
location: location
identity: {
type: 'UserAssigned'
userAssignedIdentities: {
'${userAssignedIdentityId}': {}
}
}
properties: {
siteConfig: {
appSettings: [
{
name: 'ConnectionStrings__Default'
value: '@Microsoft.KeyVault(SecretUri=https://kv-prod-01.vault.azure.net/secrets/DbConn)'
}
]
}
}
}

During deployment validation, the application fails to start, and the logs indicate that the application setting `ConnectionStrings__Default` cannot resolve the Key Vault reference.

Which configuration change must you apply to the Bicep template to ensure the web app can resolve the connection string?

  1. A
    Modify the App Service setting value to @Microsoft.KeyVault(SecretUri=https://kv-prod-01.vault.azure.net/secrets/DbConn;IdentityId=userAssignedIdentityId).
  2. B
    Revert the Key Vault permission model to Key Vault access policies and add an access policy that grants the Get secret permission directly to the Web App's resource principal.
  3. Set the keyVaultReferenceIdentity property under properties to the value of userAssignedIdentityId.Answer
  4. D
    Enable a system-assigned managed identity on the Web App and assign the user-assigned identity to the identityDelegationSettings block.

Answer

Set the keyVaultReferenceIdentity property under properties to the value of userAssignedIdentityId.
The correct solution is to set the keyVaultReferenceIdentity property under properties to the value of the user-assigned managed identity's resource ID. By default, Azure App Service attempts to resolve Key Vault configuration references using the system-assigned managed identity. When using a user-assigned identity instead, the App Service must be explicitly told which identity to use by configuring the keyVaultReferenceIdentity property.

Step-by-Step Solution

1
Analyze the Bicep template configuration
Identify that the Web App is configured with a user-assigned managed identity, but lacks configuration pointing the Key Vault resolution mechanism to this identity.
When a Key Vault reference is evaluated at runtime, the App Service host must authenticate against the Key Vault. By default, it attempts to use a system-assigned identity.
2
Determine the default identity resolution behavior
Realize that without a system-assigned identity enabled or explicit configuration, the App Service cannot authenticate to resolve `@Microsoft.KeyVault(...)` syntax.
The template uses a user-assigned managed identity instead of a system-assigned identity, so the host needs explicit guidance on which identity context to execute under.
3
Identify the required Bicep property for identity selection
Locate the keyVaultReferenceIdentity property under the properties block of Microsoft.Web/sites.
This property configures the specific user-assigned identity resource ID that the App Service host should use to authenticate against the Key Vault for App Setting reference resolution.
4
Validate the Key Vault reference syntax and RBAC configuration
Ensure the @Microsoft.KeyVault(SecretUri=...) syntax is correct and Key Vault Secrets User role is active on the user-assigned identity.
The role and syntax are already correct in the initial template, confirming that the missing keyVaultReferenceIdentity property is the sole blocker.

Key Concept

App Service Key Vault References with User-Assigned Managed Identity

Alternative Method

Alternatively, you could switch to using a system-assigned managed identity, which automatically configures the App Service to use that identity for Key Vault references without needing the keyVaultReferenceIdentity property. However, this may conflict with organizations requiring user-assigned identities for strict lifecycle management.
Estimated Time:3m 0s
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic