Question
You have several Azure App Service web apps that use Azure Key Vault to store data encryption keys.
Several departments have the following requests to support the web app:
| Department | Request |
| --- | --- |
| Security | - Review the membership of administrative roles and require users to provide a justification for continued membership.<br>- Get alerts about changes in administrator assignments.<br>- See a history of administrator activation, including which changes administrators made to Azure resources. |
| Development | - Enable the applications to access Key Vault and retrieve keys for use in code. |
| Quality Assurance | - Receive temporary administrator access to create and configure additional web apps in the test environment. |
Which service should you recommend for each department's request? To answer, configure the appropriate options in the answer area.
Explanation
Security: Azure AD Privileged Identity Management (PIM) provides access reviews that ask members to justify continued role membership, alerts on administrator role assignments, and an audit history of role activations. Development: a managed identity lets the App Service apps authenticate to Key Vault and retrieve keys without storing any credentials in code. Quality Assurance: PIM provides just-in-time, time-bound administrator access, so QA staff can be made eligible and activate the role only while they configure the test web apps.
