AZ-500 Question 29
Single answerYou are responsible for managing a line-of-business multi-tenant application registered in Microsoft Entra ID. The application's client secret will expire in a few days. You want to rotate the secret without causing disruptions to existing users. Which approach should you take?
- A
Update the existing secret's expiry date in the portal and rely on the same secret value
- B
Create a new client secret, update your application’s configuration to use the new secret, and then remove the old secret once the application is verified to be working
- C
Remove the old client secret first to ensure it cannot be used by malicious actors, then generate and configure a new secret
- D
Stop user sign-ins during the rotation process and generate a new client secret right after the old one expires
Show answer and explanation
Correct answer: B
Explanation
Secret rotation best practices in Microsoft Entra ID (formerly Azure Active Directory) recommend adding a new client secret and updating the application to use the new secret before removing the old one. This ensures continuous access without downtime. For more information, see the Microsoft documentation on managing application secrets and certificates for Microsoft Entra app registrations.
- A. Incorrect.
Incorrect. You cannot extend an existing secret’s expiration date without creating a new secret value, so relying on just an expiry date change is not possible in Microsoft Entra.
- B. Correct.
Correct. The recommended approach to ensure minimal downtime is to generate a new secret first, update the application code or configuration to use it, and then remove the old secret after verifying everything functions correctly.
- C. Incorrect.
Incorrect. Removing the old secret before configuring the new one may cause downtime or authentication failures until the new secret is in place.
- D. Incorrect.
Incorrect. There is no need to stop user sign-ins, nor should you wait until the old secret expires, as it could lead to disruption or security risk. The best practice is to add a new secret in advance and test it first.