Examkin

Soru

Zorluk: OrtaApp Registrations and Service Principals

You are developing a background daemon application that runs on an on-premises Windows server. The application must run unattended to process files and upload them to an Azure Blob Storage container. You need to configure authentication and authorization for the application, ensuring that it uses Microsoft Entra ID and adheres to the principle of least privilege.

Which of the following authentication and authorization configurations should you implement?

  1. A
    Enable a system-assigned managed identity on the on-premises Windows server, and assign the Storage Blob Data Contributor role to the managed identity.
  2. B
    Register the application in Microsoft Entra ID, configure a client secret, and grant the application registration's Application ID access to the storage account by adding it to an Azure Key Vault access policy.
  3. Register the application in Microsoft Entra ID to create an application object and a corresponding service principal, configure a certificate credential for authentication, and assign the Storage Blob Data Contributor role to the service principal.Cevap
  4. D
    Generate an Account Shared Access Signature (SAS) token with read and write permissions, configure the daemon application to use this SAS token for all storage operations, and store the token in the application configuration.

Cevap

Register the application in Microsoft Entra ID to create an application object and a corresponding service principal, configure a certificate credential for authentication, and assign the Storage Blob Data Contributor role to the service principal.
Registering the application in Microsoft Entra ID creates both an application object (defining the app globally) and a service principal (the local representation used for authentication and authorization in the tenant). Because the daemon application runs on-premises, it cannot natively use a managed identity. Authenticating using a certificate credential (rather than a client secret) provides a more secure approach for unattended daemon services. Granting the Storage Blob Data Contributor role to the service principal via Azure Role-Based Access Control (RBAC) ensures the application has only the permissions required to upload files to Blob Storage.

Adım Adım Çözüm

1
Register the application in the Microsoft Entra ID tenant.
Creates an application object (representing the app registration) and an associated service principal in the home tenant.
On-premises daemon applications must be registered in Microsoft Entra ID to obtain identity credentials.
2
Upload a public certificate to the app registration to configure a certificate credential.
Establishes a highly secure credential type for the application.
Daemon applications run unattended and require non-interactive credentials. Certificate credentials are preferred over client secrets for production environments.
3
Assign the Storage Blob Data Contributor role to the service principal at the scope of the storage account or container.
Grants the service principal the necessary write permissions to upload files.
Azure Role-Based Access Control (RBAC) maps the required permissions to the service principal identity to authorize storage operations.

Anahtar Kavram

App Registrations and Service Principals for On-Premises Daemon Applications
Bu soruyu puanla

Konular

App Registrations and Service Principals

Bu konudan daha fazla soru