An organization is developing an automated data synchronization tool that runs on an on-premises physical server. The tool must run as a background service without user interaction and read files from an Azure Blob Storage container. You register an application named DataSyncApp in your Microsoft Entra ID tenant. You need to configure the required identity and credentials to allow the synchronization tool to authenticate and access the storage container. What should you do?
- Create a client secret or upload a certificate for the application registration, and assign the Storage Blob Data Reader role to the corresponding service principal.Cevap
- BConfigure a system-assigned managed identity for the application registration, and assign the Storage Blob Data Reader role to the managed identity.
- CGenerate an ad-hoc Shared Access Signature (SAS) token with full read and write permissions, and configure the application registration manifest to expose this token.
- DCreate a Key Vault access policy that grants the application registration permissions to read keys, and use the access policy to access the storage account.
Cevap
Create a client secret or upload a certificate for the application registration, and assign the Storage Blob Data Reader role to the corresponding service principal.
To support unattended authentication for on-premises services, the application registration must be configured with a client secret or certificate credential. Permissions are then granted by assigning the appropriate Azure RBAC role to the service principal that represents the application in the tenant.
Adım Adım Çözüm
Anahtar Kavram
Configuring non-interactive daemon authentication for on-premises applications using application registration client credentials and service principal role assignments.