Examkin

Soru

Zorluk: ZorSystem-Assigned and User-Assigned Managed Identities

An organization requires a web application running on Azure App Service to query an Azure SQL Database. The security policy mandates the use of a user-assigned managed identity to eliminate hardcoded credentials. You must perform the configuration steps using the Azure CLI and SQL commands, and configure the .NET application code to connect securely. Which sequence of steps must you perform to provision, configure, and authenticate the application using the user-assigned managed identity?

  1. 1Create the user-assigned managed identity resource in your Azure subscription by executing the `az identity create` command.
  2. 2Assign the user-assigned managed identity to the Azure App Service web app by running the `az webapp identity assign` command.
  3. 3Connect to the Azure SQL Database and execute `CREATE USER [<identity-name>] FROM EXTERNAL PROVIDER` to create a contained database user, then add the user to the `db_datareader` role.
  4. 4Add an application setting named `AZURE_CLIENT_ID` containing the Client ID of the user-assigned managed identity to the App Service web app.
  5. 5Instantiate the `DefaultAzureCredential` class from the `Azure.Identity` library in the application startup code to establish the database connection.

Cevap

The correct sequence begins with creating the user-assigned managed identity using the CLI. Next, assign this identity to the Azure App Service web app. After that, create a contained user for the identity within the Azure SQL Database and grant the database reader role. Then, configure the App Service app settings by adding the client ID of the user-assigned identity to the client ID environment variable. Finally, write application code using the default Azure credential to connect to the database.
The correct sequence flows logically from infrastructure provisioning to application deployment. The identity must be created first before it can be assigned to the web app or authorized in the SQL Database. The app settings must be updated to reference the client ID before the application code is executed, allowing the default Azure credential to correctly resolve the user-assigned identity at runtime.

Adım Adım Çözüm

1
Run `az identity create` to provision the user-assigned managed identity.
A user-assigned managed identity is created in Microsoft Entra ID.
You cannot associate an identity or authorize it in other services until it exists.
2
Run `az webapp identity assign` to link the identity to the App Service web app.
The App Service is configured to use the user-assigned managed identity.
This allows the App Service infrastructure to acquire tokens on behalf of the user-assigned identity.
3
Run SQL DDL commands to create a contained user from the external provider.
The identity is authorized inside the target SQL database.
Managed identities authenticate against Microsoft Entra ID, and SQL Database must map this identity to a contained user to authorize access.
4
Set the `AZURE_CLIENT_ID` application setting on the App Service.
The application runtime environment exposes the client ID to the credential libraries.
Unlike system-assigned identities, user-assigned identities require specifying the client ID. The default Azure credential checks this environment variable to know which user-assigned identity to select.
5
Initialize `DefaultAzureCredential` and establish the database connection.
The application successfully connects to the SQL database using passwordless authentication.
The credential library automatically picks up the client ID environment variable and requests a token for Azure SQL Database from the local endpoint.

Anahtar Kavram

Configuring a user-assigned managed identity for App Service to access Azure SQL Database requires identity creation, resource association, target system authorization, runtime client ID configuration, and default SDK credential usage.
Bu soruyu puanla

Konular

System-Assigned and User-Assigned Managed Identities

Bu konudan daha fazla soru