Examkin

Soru

Zorluk: ZorConfigure Microsoft Entra ID Authentication for Storage

Your company has an Azure subscription that contains an Azure Virtual Machine named VM-App1 and a storage account named storeevents2026. VM-App1 runs a custom background service that must retrieve and delete messages from a queue named processing-queue in storeevents2026. You need to configure authentication for the service to access the queue. The solution must meet the following requirements:
- Use Microsoft Entra ID authentication.
- Follow the principle of least privilege.

Which two configurations should you perform? (Select two.)

  1. Enable a system-assigned managed identity on VM-App1.Cevap
  2. Assign the Storage Queue Data Message Processor role to the VM-App1 managed identity.Cevap
  3. C
    Assign the Storage Queue Data Reader role to the VM-App1 managed identity.
  4. D
    Assign the Storage Account Contributor role to the VM-App1 managed identity.
  5. E
    Configure a Shared Access Signature (SAS) token for the queue and store it in the service configuration.

Cevap

Enable a system-assigned managed identity on VM-App1 and assign the Storage Queue Data Message Processor role to the VM-App1 managed identity.
To authenticate and authorize access to Azure Storage Queues using Microsoft Entra ID under the principle of least privilege, two components are required: first, the virtual machine running the service must have an identity in Microsoft Entra ID. Enabling a system-assigned managed identity on the virtual machine provides it with an identity automatically managed by Azure, eliminating the need to store credentials in code or configuration. Second, the managed identity must be assigned a data-plane role that permits reading, retrieving (dequeuing), and deleting messages from the queue. The Storage Queue Data Message Processor role is the built-in role designed specifically for this purpose, providing the minimum permissions necessary to process queue messages without granting full administrative rights over the queue or the storage account.

Adım Adım Çözüm

1
Enable a system-assigned managed identity on VM-App1.
VM-App1 is registered in Microsoft Entra ID and obtains its own identity credentials managed automatically by Azure.
This establishes a secure, passwordless identity for the virtual machine to authenticate with Microsoft Entra ID.
2
Identify the data-plane operations required (retrieving and deleting queue messages) and map them to the least-privilege role.
The Storage Queue Data Message Processor role is selected because it permits peeking, retrieving, and deleting queue messages.
Other data-plane roles like Storage Queue Data Reader do not permit deleting (dequeuing) messages, while control-plane roles do not grant data-plane access.
3
Assign the Storage Queue Data Message Processor role to the VM-App1 managed identity at the scope of the queue or storage account.
The managed identity is authorized to perform message processing operations on the queue.
This completes the authorization step required by Azure role-based access control (RBAC) for Microsoft Entra ID.

Anahtar Kavram

Using Microsoft Entra ID and Azure RBAC data-plane roles to authorize access to Azure Storage resources (Queues) from an Azure Virtual Machine.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Configure Microsoft Entra ID Authentication for Storage

Bu konudan daha fazla soru