Examkin

Soru

Zorluk: ZorApp Registrations and Service Principals

An enterprise is migrating a legacy batch processing system to Azure. The system consists of an on-premises scheduler service that must securely upload transaction logs to an Azure Blob Storage container. Corporate security policies strictly prohibit storing passwords, client secrets, or access keys in the service configuration. You must establish authentication using a Microsoft Entra ID service principal configured with a client certificate.

You need to configure the required Microsoft Entra ID and Azure resources to establish this secure communication flow.

Which five actions should you perform in sequence? To answer, arrange the actions from the list of actions in the correct order.

  1. 1Generate a self-signed certificate locally and export the public key certificate (.cer) file.
  2. 2Create an application registration in Microsoft Entra ID.
  3. 3Upload the public key (.cer) file to the Certificates & secrets section of the application registration.
  4. 4Assign the Storage Blob Data Contributor role to the application's service principal at the storage account scope.
  5. 5Configure the scheduler service to authenticate using the client certificate's private key to acquire an Entra ID token.

Cevap

Generate a self-signed certificate locally and export the public key -> Create an application registration in Microsoft Entra ID -> Upload the public key certificate to the application registration -> Assign the Storage Blob Data Contributor role to the application's service principal -> Configure the scheduler service to authenticate using the client certificate's private key.
Establishing a secure connection without secrets requires a certificate-based flow. First, the certificate pair must be generated on the client machine to create the public key. Next, the application is registered in Microsoft Entra ID to establish its identity. After registration, the public key is uploaded to Microsoft Entra ID to associate the credential with the registration. Next, the Storage Blob Data Contributor role is assigned to the service principal in the tenant to allow data plane access. Finally, the daemon scheduler is configured with the private key locally to acquire access tokens using the client credentials flow.

Adım Adım Çözüm

1
Generate a self-signed certificate locally and export the public key certificate (.cer) file.
A public/private key pair is created, and the public key is saved in a .cer file.
This establishes the cryptographic trust foundation where the private key remains secure on-premises.
2
Create an application registration in Microsoft Entra ID.
An application object is created globally, and a corresponding service principal is generated in the home tenant.
A directory identity must exist before you can assign credentials or configure access permissions.
3
Upload the public key (.cer) file to the Certificates & secrets section of the application registration.
The public key is bound as a credential to the Entra ID application object.
This allows Microsoft Entra ID to validate signed JSON Web Tokens (JWTs) presented as client assertions during authentication.
4
Assign the Storage Blob Data Contributor role to the application's service principal at the storage account scope.
The service principal is granted read/write permissions to the blob storage data plane.
Security permissions are evaluated against the service principal (the local instance of the app in the tenant), not the application object itself.
5
Configure the scheduler service to authenticate using the client certificate's private key to acquire an Entra ID token.
The service requests and receives an access token from the Microsoft Entra ID token endpoint to perform authorized blob operations.
The client application uses the private key to sign a client assertion locally, preventing any secret or key transmission over the network.

Anahtar Kavram

Configuring certificate-based client credentials flow using Microsoft Entra ID application registrations, local service principals, and role assignments.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

App Registrations and Service Principals

Bu konudan daha fazla soru