AZ-500 Question 37
Select 2You are an Azure Security Engineer responsible for configuring a custom microservice that deploys Azure resources only within a specific resource group. The microservice runs on Azure Container Instances and must authenticate with Azure Resource Manager using a service principal. You are asked to implement the service principal with the least possible privileges. Which two actions should you perform? (Choose two.)
- A
Create a new App Registration and generate a client secret, then store the secret securely in Azure Key Vault with restricted access policies.
- B
Assign the 'Contributor' role to the service principal at the management group scope to ensure it can modify resources across the tenant.
- C
Assign the 'Contributor' role to the service principal only at the resource group scope where the microservice deploys resources.
- D
Enable Multi-Factor Authentication (MFA) on the service principal to prevent all unauthorized logins.
Show answer and explanation
Correct answers: A, C
Explanation
By applying the principle of least privilege, Azure best practices recommend assigning the minimum required role at the scope needed (in this case, the resource group level), and securely storing secrets (e.g., in Azure Key Vault). You can find additional guidance in Microsoft's documentation on managing service principals and best practices for secret management in Azure.
- A. Correct.
Option 1 is correct. Creating the App Registration, generating a client secret, and storing it in Azure Key Vault aligns with best practices for credential management. It ensures secure storage of secrets and helps reduce the risk of exposure.
- B. Incorrect.
Option 2 is incorrect. Assigning the Contributor role at the management group scope is too broad and violates the principle of least privilege. It would grant the service principal permissions across the entire tenant instead of restricting it to the required resource group.
- C. Correct.
Option 3 is correct. Granting Contributor permissions at the resource group scope confines the service principal to only what is necessary for that microservice's deployments. This approach follows the principle of least privilege by restricting permissions to that specific resource group.
- D. Incorrect.
Option 4 is incorrect. Service principals are non-interactive application identities in Azure AD, so enabling MFA is neither supported nor necessary. MFA is meant for interactive user sign-ins, not service principal authentication.