Examkin

Question

Difficulty: MediumApp Registrations and Service Principals

You are developing a web application that will be hosted on an on-premises web server. The application must programmatically retrieve database connection strings stored as secrets in an Azure Key Vault.

You need to configure the security and authentication requirements to allow the application to access the secrets.

Which of the following actions should you perform?

  1. Register the application in Microsoft Entra ID to create an application object and a service principal, configure a client secret or certificate for the registration, and grant the service principal access to the secrets in the Key Vault access policy.Answer
  2. B
    Enable a system-assigned managed identity on the on-premises web server, and grant that managed identity access to the secrets in the Key Vault access policy.
  3. C
    Register the application in Microsoft Entra ID, configure a client secret in the application registration, and reference the secrets in Azure App Configuration using Key Vault references without modifying the Key Vault access policy.
  4. D
    Register the application in Microsoft Entra ID, and generate a Shared Access Signature (SAS) token with Read permissions from the Key Vault to authenticate the application directly.

Answer

Register the application in Microsoft Entra ID to create an application object and a service principal, configure a client secret or certificate for the registration, and grant the service principal access to the secrets in the Key Vault access policy.
The correct option outlines the standard process for enabling an application running outside of Azure (on-premises) to authenticate and access Azure Key Vault. Since it is hosted on-premises, it cannot use Azure Managed Identities. It requires an Application Registration in Microsoft Entra ID to establish a service principal. The application uses a client secret or certificate to authenticate as this service principal, which must be granted the necessary permissions in the Key Vault access policy to retrieve the secrets.

Step-by-Step Solution

1
Register the application in Microsoft Entra ID.
This creates an application object (definition) and a corresponding service principal (local representation/identity) in the tenant.
An identity is required for the application to authenticate against Microsoft Entra ID.
2
Configure credentials (a client secret or certificate) for the application registration.
The application can now use these credentials to obtain an access token from Microsoft Entra ID.
Since the application runs on-premises, it cannot use managed identities directly and must supply credentials to authenticate.
3
Grant the service principal permission to get secrets in the Azure Key Vault access policy.
The service principal is authorized to retrieve the secrets.
Microsoft Entra ID authentication only proves identity; authorization must be configured at the target resource (Key Vault).

Key Concept

App Registrations and Service Principals are used to establish a security identity for applications, especially when running outside of Azure where Managed Identities are not supported.
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic