AZ-500 Question 39
Select 2You are an Azure Security Engineer for Contoso. You have created a service principal to run a script that retrieves secrets from an Azure Key Vault. The service principal can successfully authenticate to Azure AD, but the script still fails to retrieve the secrets. You suspect an Azure Key Vault access or configuration issue. Which two actions should you take to resolve the problem?
- A
Configure an access policy granting the service principal 'Get' and 'List' permissions for secrets in the Key Vault.
- B
Grant admin consent to the Microsoft Graph permissions for the Key Vault enterprise application.
- C
Assign the service principal the 'Owner' role at the subscription scope so it can retrieve secrets from the Key Vault.
- D
If Key Vault firewall is enabled, allow the script’s source IP or Virtual Network in the Key Vault firewall settings.
Show answer and explanation
Correct answers: A, D
Explanation
To properly grant a service principal access to secrets in Azure Key Vault, you must configure an access policy with the appropriate permissions ('Get' and 'List' for secrets) or use RBAC roles at the Key Vault scope if enabled. Additionally, if you have Key Vault firewall restrictions in place, you must allow the script’s IP address or Virtual Network, or else access will be denied. For more information, see the Microsoft documentation on Azure Key Vault authentication and access control: https://learn.microsoft.com/azure/key-vault/general/authentication.
- A. Correct.
Correct. To retrieve secrets from Key Vault, the service principal must have appropriate permissions. Configuring an access policy (or using Role-Based Access Control, if supported) with 'Get' and 'List' is necessary for reading secrets.
- B. Incorrect.
Incorrect. Granting admin consent for Microsoft Graph permissions is unrelated to granting the service principal access to secrets in the Key Vault. Key Vault does not require Microsoft Graph API permissions in this context.
- C. Incorrect.
Incorrect. Assigning the service principal an 'Owner' role on the entire subscription is excessive and is not the recommended least-privilege approach. Key Vault access should be granted at the vault level using either an access policy or a targeted Azure RBAC role.
- D. Correct.
Correct. If the Key Vault firewall is enabled, any callers (including scripts) must come from allowed IP addresses or Azure Virtual Networks. Failing to configure these settings prevents the script from connecting to the vault, even if the access policy is configured correctly.