Examkin

Soru

Zorluk: Çok zorApp Registrations and Service Principals

A developer needs to configure passwordless authentication for a GitHub Actions workflow to deploy resources to an Azure subscription using Microsoft Entra Workload Identity. In which order should the developer perform the steps to establish trust and grant the necessary permissions? To answer, arrange the steps in the correct sequence.

  1. 1Register the application in Microsoft Entra ID using the Azure CLI command az ad app create.
  2. 2Create a service principal for the registered application in the home tenant using the Azure CLI command az ad sp create.
  3. 3Configure a federated identity credential on the application registration using the Azure CLI command az ad app federated-credential create.
  4. 4Grant the service principal the necessary permissions on the target Azure subscription using the Azure CLI command az role assignment create.
  5. 5Update the GitHub Actions workflow YAML file to request an OIDC token and call the login action using the client and tenant identifiers.

Cevap

First, register the application. Second, create the service principal. Third, configure the federated identity credential on the application registration. Fourth, grant the service principal permissions on the target subscription. Finally, update the GitHub Actions workflow YAML file.
Establishing Workload Identity federation requires a sequential chain of trust. First, the application object is registered globally. Second, a local service principal is created to represent it in the home tenant. Third, a federated identity credential is added to the application registration to trust GitHub's OIDC issuer. Fourth, the service principal is assigned an RBAC role to grant resource management permissions. Finally, the GitHub Actions workflow YAML is configured with the target client and tenant IDs, and the required `id-token: write` permission to exchange its GitHub OIDC token for an Entra access token.

Adım Adım Çözüm

1
Register the application in Microsoft Entra ID.
An application object is created, generating a unique Application (Client) ID.
This establishes the identity template that defines the application.
2
Create the service principal.
A service principal object is created in the local tenant.
This represents the application instance in the tenant and is required to assign roles and permissions.
3
Create a federated identity credential.
Trust is established between Entra ID and the external OIDC token issuer (GitHub).
This allows Entra ID to trust security tokens issued by GitHub Actions for this specific repository and branch.
4
Assign the RBAC role.
The service principal is authorized to manage resources.
Roles must be assigned to the service principal in the tenant so that the authenticated session has the necessary execution permissions.
5
Configure the GitHub Actions workflow YAML.
The workflow can successfully obtain an Entra ID access token and login.
The workflow must request the OIDC token (`id-token: write`) and present the client and tenant IDs during authentication.

Anahtar Kavram

Microsoft Entra Workload Identity federation utilizes an application registration, its corresponding service principal, and federated identity credentials to allow external workloads (like GitHub Actions) to authenticate securely without maintaining client secrets or certificates.
Bu soruyu puanla

Konular

App Registrations and Service Principals

Bu konudan daha fazla soru