Soru

Zorluk: OrtaApp Registrations and Service Principals

An organization is developing an automated data synchronization tool that runs on an on-premises physical server. The tool must run as a background service without user interaction and read files from an Azure Blob Storage container. You register an application named DataSyncApp in your Microsoft Entra ID tenant. You need to configure the required identity and credentials to allow the synchronization tool to authenticate and access the storage container. What should you do?

  1. Create a client secret or upload a certificate for the application registration, and assign the Storage Blob Data Reader role to the corresponding service principal.Cevap
  2. B
    Configure a system-assigned managed identity for the application registration, and assign the Storage Blob Data Reader role to the managed identity.
  3. C
    Generate an ad-hoc Shared Access Signature (SAS) token with full read and write permissions, and configure the application registration manifest to expose this token.
  4. D
    Create a Key Vault access policy that grants the application registration permissions to read keys, and use the access policy to access the storage account.

Cevap

Create a client secret or upload a certificate for the application registration, and assign the Storage Blob Data Reader role to the corresponding service principal.
To support unattended authentication for on-premises services, the application registration must be configured with a client secret or certificate credential. Permissions are then granted by assigning the appropriate Azure RBAC role to the service principal that represents the application in the tenant.

Adım Adım Çözüm

1
Add a credential (client secret or certificate) to the DataSyncApp application registration in Microsoft Entra ID.
Allows the on-premises background service to authenticate securely with Microsoft Entra ID.
On-premises resources cannot use Azure Managed Identities natively, so they require client credentials to authenticate.
2
Locate the service principal (enterprise application) created automatically in the tenant during registration.
Identifies the local representation of the application registration used for security policy enforcement.
Permissions in Microsoft Entra ID are assigned to the service principal object, not the application object itself.
3
Assign the Storage Blob Data Reader role to the service principal at the scope of the target storage container or storage account.
Grants the tool the necessary read-only permissions on Azure Blob Storage data plane resources.
Azure Role-Based Access Control (RBAC) is the standard method for managing secure access to Azure Storage services.

Anahtar Kavram

Configuring non-interactive daemon authentication for on-premises applications using application registration client credentials and service principal role assignments.
Bu soruyu puanla