AZ-500 Question 128
Select 3Your organization is deploying a new Azure Kubernetes Service (AKS) cluster and wants to enforce Azure Active Directory (Azure AD) authentication. You need to ensure that each user who accesses the cluster is authenticated through Azure AD and that you can map their Azure AD group memberships to Kubernetes RBAC roles. Which of the following steps are required as part of enabling Azure AD authentication on your AKS cluster? (Choose three.)
- A
Register two Azure AD apps (server and client) and configure the server app’s API permissions to allow user impersonation.
- B
Include the server and client application IDs in your cluster creation or update command along with the --enable-aad parameter.
- C
Configure a container manifest that specifies local user credentials as the primary method for cluster sign-in.
- D
Specify an Azure AD group as the cluster’s admin group via the aad-admin-group-object-ids parameter when creating or updating the cluster.
- E
Manually store and rotate all user credentials in the kubeconfig file on a monthly basis.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enforce Azure AD-based authentication in AKS, you typically register two Azure AD applications (for manual configuration), specify them during AKS creation or update, and define an Azure AD group that will serve as the cluster administrator group. These steps integrate AKS with Azure AD, enabling token-based authentication and enforcing role-based access through group membership. Refer to the Azure documentation on ‘Integrate Azure Active Directory with Azure Kubernetes Service’ (https://learn.microsoft.com/azure/aks/manage-azure-rbac) for detailed guidance.
- A. Correct.
Option 1 is correct. In a manual AD integration approach, you must have two Azure AD applications (server and client). The server app handles user impersonation permissions, and the client app is used to authenticate users via prompts.
- B. Correct.
Option 2 is correct. When you create or update an AKS cluster, you must enable Azure AD with the --enable-aad parameter in the Azure CLI. You also need to specify the Azure AD application IDs so the cluster knows which apps to trust.
- C. Incorrect.
Option 3 is incorrect. Configuring local user credentials in a container manifest does not integrate with Azure AD. Azure AD integration relies on OAuth tokens and does not require local accounts in the cluster for authentication.
- D. Correct.
Option 4 is correct. Specifying an Azure AD group for the cluster’s admin group is a standard step to ensure that group’s members have the required administrative privileges. This is done using the aad-admin-group-object-ids parameter.
- E. Incorrect.
Option 5 is incorrect. With Azure AD integration enabled, users sign in via their Azure AD accounts. You don’t need to manually rotate credentials in kubeconfig files; authentication tokens are issued and managed by Azure AD.