Examkin

Question

Difficulty: EasySystem-Assigned and User-Assigned Managed Identities

You are deploying a single Azure App Service web app that needs to retrieve database credentials securely. You want to enable a managed identity for the web app to access Azure Key Vault. The identity must share the lifecycle of the App Service resource, meaning that if the App Service is deleted, the identity is automatically cleaned up. Which identity type or configuration should you implement for the App Service?

  1. A system-assigned managed identityAnswer
  2. B
    A user-assigned managed identity
  3. C
    An App Registration service principal with a client secret
  4. D
    A Key Vault access policy without an associated identity

Answer

A system-assigned managed identity
A system-assigned managed identity is enabled directly on an Azure resource (such as an App Service). Its lifecycle is bound directly to that resource; when the host resource is deleted, Azure automatically deletes the identity in Microsoft Entra ID. This avoids leaving orphaned identity resources behind and simplifies lifecycle management.

Step-by-Step Solution

1
Analyze the requirements for the identity lifecycle.
The identity must be tied directly to the lifecycle of the App Service and deleted automatically if the App Service is deleted.
This requirement determines whether a system-assigned or user-assigned identity is appropriate.
2
Compare system-assigned and user-assigned managed identity lifecycles.
System-assigned identities are tied to the host resource's lifecycle, while user-assigned identities are standalone resources with independent lifecycles.
System-assigned identities satisfy the requirement of automatic cleanup upon resource deletion.
3
Select the correct configuration option.
Enable a system-assigned managed identity on the App Service.
This aligns exactly with the design goal of automatic lifecycle cleanup.

Key Concept

Managed Identity Lifecycle Management
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic