AZ-305 Question 16
Select 2You have an Azure Web App named ContosoApp that needs to retrieve secrets from Azure Key Vault using a system-assigned managed identity. You have already enabled the system-assigned identity for ContosoApp in Azure Active Directory. Which two configuration changes must you perform to allow ContosoApp to fetch secrets from Azure Key Vault?
- A
A) Enable the Managed Identity in the Key Vault by creating a matching service principal within the vault's access policy configuration.
- B
B) Grant the system-assigned identity an access policy in the Key Vault with the appropriate secret permissions (e.g., Get).
- C
C) Modify ContosoApp's Azure AD registration, adding a custom redirect URI matching the Key Vault address.
- D
D) Register ContosoApp in Azure Key Vault, providing a client secret and custom secret scope.
- E
E) Assign the built-in Key Vault Secrets User role to ContosoApp’s managed identity at the scope of the Key Vault.
Show answer and explanation
Correct answers: B, E
Explanation
To enable an Azure Web App's system-assigned managed identity to access secrets in Azure Key Vault, you must grant the identity the necessary permissions. This can be achieved in two main ways: (1) configuring a Key Vault Access Policy granting the identity 'Get' (and other required) permissions, or (2) using Azure RBAC roles like Key Vault Secrets User assigned at the Key Vault scope. Both approaches allow the managed identity to authenticate silently and fetch secrets securely. Refer to Microsoft documentation on 'Azure Key Vault managed identities' for official guidelines.
- A. Incorrect.
A) Incorrect. You do not enable a managed identity 'inside' Key Vault by creating a separate service principal. Key Vault relies on granting access to the already-existing managed identity in Azure AD. You do this through either Key Vault access policies or role assignments granted to the identity.
- B. Correct.
B) Correct. You must give ContosoApp’s managed identity explicit permissions to retrieve secrets from Key Vault. This can be done by configuring an access policy in Key Vault and selecting the 'Get' secret permission (among others if needed) for the managed identity.
- C. Incorrect.
C) Incorrect. Configuring custom redirect URIs is relevant for some interactive or OAuth 2.0 authorization flows, but it is not required for a system-assigned managed identity to access Key Vault. Managed identity authentication to Key Vault happens automatically without needing a redirect URI.
- D. Incorrect.
D) Incorrect. You do not manually register applications in Azure Key Vault with client secrets. That approach applies to service principals that do not leverage managed identities. For a system-assigned managed identity, Key Vault access is granted through Azure AD without manually issuing secrets or registering in Key Vault.
- E. Correct.
E) Correct. In some scenarios, especially when using Azure RBAC for Key Vault, you assign the built-in Key Vault access roles (e.g., Key Vault Secrets User) to the managed identity at the Key Vault scope. This approach allows the identity to retrieve secrets from the vault without the need for a specific access policy.