AZ-500 Question 40
Single answerYour organization has several Azure Web Apps that all need to retrieve secrets from Azure Key Vault. You want to use a common identity to simplify permissions management, and you also need the identity to persist even if an individual Web App is recreated. Which approach should you choose to meet these requirements?
- A
Assign a system-assigned managed identity to each Web App individually.
- B
Create a user-assigned managed identity and link it to all required Web Apps.
- C
Store and rotate secrets manually in each Web App’s application settings.
- D
Configure a single system-assigned identity in one Web App and reuse that identity across the others.
Show answer and explanation
Correct answer: B
Explanation
Using user-assigned managed identities ensures that the identity is created, managed, and scoped independently of any single resource. If you delete or recreate a Web App, the identity persists and can simply be reattached, which helps maintain consistent permissions across multiple apps. Refer to Microsoft documentation for best practices on managed identities: https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview.
- A. Incorrect.
Option 1: Incorrect. A system-assigned managed identity is tied to the lifespan of the specific resource that creates it. If you delete a Web App, its system-assigned identity is also deleted. This doesn’t meet the requirement for persisting the same identity across resource deletions and recreations.
- B. Correct.
Option 2: Correct. A user-assigned managed identity is a standalone Azure resource that persists independently from the Web App. This allows you to attach the same identity to multiple resources and keep consistent permissions, satisfying the stated requirements.
- C. Incorrect.
Option 3: Incorrect. Storing and rotating secrets manually across each Web App’s settings is more cumbersome, error-prone, and less secure than using managed identities. This approach does not leverage the benefits of Azure-managed credentials.
- D. Incorrect.
Option 4: Incorrect. System-assigned identities cannot be directly shared across resources because each resource has its own unique identity. You can’t reuse a system-assigned identity from one Web App in another.