Examkin

Question

Difficulty: EasyConfigure Azure App Service Web Apps

A developer deploys a web application to an Azure App Service Web App. The developer configures an application setting named DbPassword to reference a secret in Azure Key Vault. The syntax of the reference is verified as correct. However, at runtime, the application cannot retrieve the password and displays an authorization error. Which of the following is the most likely cause of this error?

  1. The App Service Web App's managed identity has not been granted Get secret permissions in the Key Vault access policies.Answer
  2. B
    The Key Vault reference in the application settings is configured using a system-assigned managed identity, which is unsupported for resolving Key Vault secrets.
  3. C
    The DbPassword application setting value is missing the mandatory @Microsoft.KeyVault prefix wrapper.
  4. D
    The autoscale rules for the App Service Web App are configured with conflicting thresholds, causing the app instance to reboot before retrieving the secret.

Answer

The App Service Web App's managed identity has not been granted Get secret permissions in the Key Vault access policies.
The correct answer is correct because Azure App Service requires the web app's managed identity (either system-assigned or user-assigned) to have GET secret permissions on the Azure Key Vault access policies to successfully resolve Key Vault references at runtime. Without this permission, the app cannot retrieve the secret value.

Step-by-Step Solution

1
Verify the syntax of the Key Vault reference in the App Service application settings.
The syntax is verified as correct, ruling out syntax errors.
Ensures that the application setting is properly directed to the Key Vault secret.
2
Check the identity configuration of the Web App and the corresponding access policies in the Key Vault.
The identity is enabled but lacks the GET permission in Key Vault.
App Service requires explicit authorization to read Key Vault secrets using its managed identity.
3
Grant the GET permission to the Web App's managed identity in the Key Vault access policies.
The Web App successfully retrieves and resolves the secret value at runtime.
Allows the App Service host to authenticate and retrieve the secret on behalf of the application.

Key Concept

Key Vault references in Azure App Service allow web apps to retrieve secrets using managed identities, which requires proper access policies (GET permissions) on the Key Vault.
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic