Microsoft Certified: Identity and Access Administrator AssociateImplement an authentication and access management solutionEasy
A pilot project team is developing a new line-of-business application that will be hosted on Azure App Service. This application needs to securely access data from an Azure SQL Database and secrets from Azure Key Vault. The developers want to avoid embedding credentials in the application code or configuration files. Which Azure AD feature provides the most secure and manageable solution for this scenario?
- AService principals with client secrets
- BConditional Access policies
- CManaged identities for Azure resources
- DAzure AD Application proxy
Show answer & explanationAnswer & explanation
Correct answer: C. Managed identities for Azure resources
Managed identities for Azure resources provide an automatically managed identity in Azure AD for Azure services, eliminating the need for developers to manage credentials. This is the most secure and manageable solution for Azure-hosted applications accessing other Azure resources.
Why the other options are wrong
- A. Service principals with client secrets require manual secret management, which the scenario aims to avoid.
- B. Conditional Access policies are for enforcing access controls based on conditions, not for providing identities for applications.
- D. Azure AD Application proxy is for publishing on-premises web applications to external users, not for internal Azure service authentication.
Managed Identities for Azure Resources
Managed identities provide an automatically managed identity in Azure Active Directory for Azure services. This allows Azure services to authenticate to services that support Azure AD authentication without managing credentials.
- Eliminates the need to store credentials in code or configuration.
- Automatically managed by Azure.
- Can be system-assigned (tied to a resource) or user-assigned (standalone).
Memory trick: Managed identities are like having Azure itself manage your app's ID card.