Soru

Zorluk: KolaySystem-Assigned and User-Assigned Managed Identities

You are developing a web application that will be hosted on an Azure App Service. The application must securely retrieve database connection strings from an Azure Key Vault. You decide to use a managed identity to authenticate to the Key Vault. The identity must be dedicated to this specific App Service instance, and its lifecycle must be tied directly to the App Service so that deleting the App Service automatically deletes the identity. Which identity type should you implement?

  1. A system-assigned managed identityCevap
  2. B
    A user-assigned managed identity
  3. C
    An Azure AD App Registration service principal with a client secret
  4. D
    A system-assigned managed identity configured with an external access policy secret

Cevap

A system-assigned managed identity
A system-assigned managed identity is directly associated with a single Azure resource instance. Enabling it creates an identity in Azure Active Directory (Microsoft Entra ID) that is tied to that resource's lifecycle. When the App Service is deleted, the identity is automatically removed by Azure, fulfilling the scenario's lifecycle requirement without manual management.

Adım Adım Çözüm

1
Analyze the lifecycle requirement
The identity's lifecycle must match the App Service lifecycle, deleting when the App Service is deleted.
This requirement determines whether a system-assigned or user-assigned identity is appropriate, as system-assigned identities share their lifecycle with the host resource.
2
Evaluate identity characteristics
System-assigned identities are automatically deleted when the parent resource is deleted. User-assigned identities exist as independent Azure resources and must be manually deleted.
Selecting the system-assigned option satisfies the automatic cleanup and exclusive access requirements.

Anahtar Kavram

Managed Identity Lifecycle Boundaries
Bu soruyu puanla