You are developing a C# daemon application that runs as a background service on an on-premises Windows server. The application must connect to Azure Blob Storage to process files and authenticate to the Microsoft Identity Platform to obtain access tokens. The solution must meet the following security requirements:
- The application must authenticate without user interaction.
- Credentials must not be stored in cleartext in the application files.
- The authentication mechanism must follow the principle of least privilege.
You need to configure the authentication for the application using MSAL.NET. Which two actions should you perform?
- Initialize the application using ConfidentialClientApplicationBuilder.Create(clientId).WithCertificate(certificate).Build() pointing to a locally installed certificate.Cevap
- BConfigure a system-assigned managed identity on the on-premises Windows server and retrieve tokens using DefaultAzureCredential.
- Request the access token by calling AcquireTokenForClient with the scope parameter set to https://storage.azure.com/.default.Cevap
- DGenerate a Shared Access Signature (SAS) token with full administrative permissions at the storage account level and embed the token in the application code.
Cevap
To securely configure MSAL.NET for the on-premises daemon application, you must use a certificate with ConfidentialClientApplicationBuilder and request the token via AcquireTokenForClient specifying the /.default scope.
A background daemon application running on-premises must authenticate without user interaction as a confidential client. Using a client certificate allows the application to authenticate securely to Microsoft Entra ID without exposing cleartext credentials in local configuration files. Furthermore, because daemon applications do not act on behalf of a user, they must request application-only permissions using the client credentials flow, which requires the scope to be configured with the default resource suffix (e.g., https://storage.azure.com/.default).
Adım Adım Çözüm
Anahtar Kavram
Daemon applications using MSAL.NET must build confidential client instances using certificates for secure on-premises deployments and request tokens using the /.default scope.