Microsoft Certified: Azure Security Engineer AssociateManage identity and accessHard
A security architect is designing a solution for a new application that will be hosted in Azure Kubernetes Service (AKS). The application needs to securely access Azure Key Vault to retrieve secrets and Azure SQL Database to store data. The architect wants to avoid managing credentials or secrets within the application code. Which Azure AD feature should be used to achieve this secure access?
- AAzure AD Conditional Access
- BAzure AD Service Principals
- CAzure AD Application Registrations
- DAzure AD Managed Identities
Show answer & explanationAnswer & explanation
Correct answer: D. Azure AD Managed Identities
Azure AD Managed Identities provide an automatically managed identity for Azure services, including applications running in AKS. This eliminates the need for developers to manage credentials, as Azure AD handles the lifecycle of the identity. The AKS cluster or pods can be assigned a managed identity, which then authenticates to Key Vault and SQL Database using Azure AD authentication, adhering to the principle of least privilege.
Why the other options are wrong
- A. Conditional Access enforces policies for user access, it's not a mechanism for applications to authenticate to Azure services.
- B. Service Principals are identities for applications, but they typically require manual management of client secrets or certificates, which the question seeks to avoid.
- C. Application Registrations define an application's identity in Azure AD but don't inherently provide a credential-less mechanism for Azure resource access like Managed Identities do.
Azure AD Managed Identities
Automatically managed identities in Azure AD for Azure services, eliminating the need for developers to manage credentials.
- No credentials in code.
- Two types: System-assigned and User-assigned.
- Integrates with Azure AD authentication for services.
Memory trick: Managed Identity: Machines Manage Identity.