Question
You have an Azure key vault named KV1 that uses role-based access control (RBAC) authorization. KV1 stores database connection strings for an Azure App Service web app named App1.
You enable a firewall on KV1 and allow access to KV1 from only the virtual network that contains App1.
You need to ensure that App1 can retrieve secrets from KV1 without using credentials stored in the application configuration.
What should you create?
- A. an access policy for KV1
- B. an app registration for App1
- C. a private endpoint for KV1
- D. a managed identity for App1 Correct
Explanation
A managed identity lets App1 authenticate to Key Vault with no stored credentials, and with RBAC authorization you then assign it the Key Vault Secrets User role. An access policy belongs to the vault access policy permission model, so it does not apply to a vault that uses RBAC. An app registration would need a client secret or certificate that App1 has to hold. The firewall already allows the virtual network that contains App1, so a private endpoint adds nothing and does not solve authentication.
