Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are developing an ASP.NET Core web application that will be hosted on an Azure App Service. The application must securely read blobs from an Azure Storage container. You decide to use a user-assigned managed identity to handle authentication.

Which sequence of steps should you perform to provision, configure, and utilize the user-assigned managed identity to access the storage container?

  1. 1Create a user-assigned managed identity in Microsoft Entra ID.
  2. 2Associate the user-assigned managed identity with the Azure App Service instance.
  3. 3Assign the Storage Blob Data Reader RBAC role to the user-assigned managed identity at the storage container scope.
  4. 4Instantiate the DefaultAzureCredential class in the application code, passing the Client ID of the user-assigned managed identity to the constructor options.

Answer

The correct sequence is to first create the user-assigned managed identity, then associate it with the Azure App Service instance, then assign the Storage Blob Data Reader RBAC role to the identity at the storage container scope, and finally instantiate the DefaultAzureCredential class in the application code by passing the Client ID of the identity to the constructor options.
The correct sequence begins with provisioning the user-assigned managed identity. Once created, the identity is linked to the App Service hosting environment. Next, the identity is granted the Storage Blob Data Reader role to authorize access. Finally, the application code initiates authentication using DefaultAzureCredential configured with the identity's Client ID.

Step-by-Step Solution

1
Create the user-assigned managed identity resource.
A standalone user-assigned managed identity resource is created with its own Client ID and Principal ID.
The identity must exist in Microsoft Entra ID before it can be associated with hosts or granted access permissions.
2
Associate the user-assigned managed identity with the App Service.
The identity is linked to the App Service host instance, permitting it to request tokens for this identity.
The hosting platform must be aware of the identity to expose its credentials through the local metadata endpoint.
3
Create an RBAC role assignment for the identity on the Storage account.
The identity is granted the Storage Blob Data Reader role at the container or storage account scope.
The identity needs explicit authorization to perform data plane operations on the Azure Storage resource.
4
Configure the application code to use the identity client ID.
The application code uses DefaultAzureCredential with the specific Client ID to request a token and read blobs.
Without the client ID, DefaultAzureCredential will default to a system-assigned managed identity and fail since only a user-assigned identity is associated.

Key Concept

Provisioning and configuring a user-assigned managed identity for Azure App Service authorization
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic