AZ-500 Question 41
Select 2You have an Azure Web App that needs to securely read secrets from your organization's Azure Key Vault. To achieve this, you enable a system-assigned managed identity on the Azure Web App. Which two steps should you take to ensure the Web App can successfully retrieve secrets from Key Vault?
- A
Enable the system-assigned managed identity in the Web App's Identity blade and grant it the required secret permissions under Key Vault Access Policies.
- B
Add an Azure RBAC role assignment for the Web App's identity in the Azure portal, specifying the Key Vault Contributor role at the subscription level.
- C
Create an external user in Azure Active Directory matching the Web App name and then assign it the Key Vault Reader role.
- D
Add a firewall rule to Key Vault to allow the Web App's outbound IP addresses.
- E
Grant the Web App's system-assigned managed identity the ‘Get’ and 'List' secret permissions through the Key Vault’s Access Policies or Role Assignments.
Show answer and explanation
Correct answers: A, E
Explanation
In Azure, a system-assigned managed identity for a Web App automatically creates a service principal in Azure AD that the Key Vault can recognize. To give the Web App access to read secrets, you must enable the Web App’s managed identity and then assign the minimal necessary permissions, typically ‘Get’ and 'List' for secrets. Azure Key Vault Access Policies or RBAC roles at the Key Vault resource scope can be used to grant these permissions. For more details, see the official Azure documentation at https://learn.microsoft.com/azure/key-vault/general/managed-identity.
- A. Correct.
Correct. You must enable the system-assigned identity in the Azure Web App and assign the necessary secret permissions within the Key Vault. This is typically done in the Key Vault's Access Policies or by assigning a role in the Key Vault scope that includes secret read permissions.
- B. Incorrect.
Incorrect. Granting a subscription-level Key Vault Contributor role is overly broad and violates least-privilege principles. While you can use Azure RBAC at the Key Vault resource scope, assigning roles at subscription-level is not recommended for just reading secrets.
- C. Incorrect.
Incorrect. There's no need to create an external user in Azure AD. The Web App’s system-assigned managed identity is automatically provisioned and managed by Azure; it appears as a service principal in Azure AD, not as an external user.
- D. Incorrect.
Incorrect. If the Key Vault allows public network access, you do not need to add specific firewall rules for the Web App’s outbound IP addresses. Firewall rules are only necessary if you have restricted the Key Vault to selected networks. Even then, a managed identity access approach can work with Role-Based Access Control (RBAC) or Access Policies without requiring IP allowlisting.
- E. Correct.
Correct. In addition to turning on the managed identity, you must grant it the appropriate Key Vault permissions. Using either Access Policies or RBAC at the Key Vault resource level is necessary to give the identity ‘Get’ and 'List' permissions for secrets.