Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsEasy
A financial services company is developing a new serverless application on Azure that uses Azure Functions and Azure Storage. The application needs to securely access data in an Azure SQL Database. The security team mandates that no connection strings or secrets should be stored directly in the application code or configuration files. Which authentication mechanism should be used for the Azure Function to access Azure SQL Database?
- ASQL Authentication with connection string
- BAzure Key Vault for connection strings
- CManaged Identities for Azure Resources
- DActive Directory Federation Services (AD FS)
Show answer & explanationAnswer & explanation
Correct answer: C. Managed Identities for Azure Resources
Managed Identities for Azure Resources provide an automatically managed identity in Azure Active Directory (Azure AD) for Azure services. This allows Azure Functions to authenticate to Azure SQL Database without storing any credentials in the code, meeting the security requirement.
Why the other options are wrong
- A. SQL Authentication requires connection strings with credentials, violating the 'no secrets in code' mandate.
- B. While Azure Key Vault is good for storing secrets, Managed Identities eliminate the need to retrieve secrets from Key Vault, offering a more direct and secure approach for service-to-service authentication.
- D. AD FS is an on-premises identity solution and not directly used for service-to-service authentication in Azure without secrets.
Managed Identities
Managed Identities for Azure Resources provide an automatically managed identity in Azure Active Directory (Azure AD) for applications to authenticate to cloud services without storing credentials in code.
- Eliminates the need for developers to manage credentials.
- Identities are managed by Azure AD.
- Can be assigned to Azure services like Virtual Machines, Azure Functions, App Services.
Memory trick: Managed Identity: The Azure-provided ID card for services.