Microsoft
AZ-204 · Question #195
You have an application that includes an Azure Web app and several Azure Function apps. Application secrets including connection strings and certificates are stored in Azure Key Vault. Secrets must no
The correct answer is A. Create a single user-assigned Managed Identity with permission to access Key Vault and. Key Vault references will use the app's system assigned identity by default, but you can specify a user-assigned identity. https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references
Submitted by renata2k· Mar 30, 2026Implement Azure security
Question
You have an application that includes an Azure Web app and several Azure Function apps. Application secrets including connection strings and certificates are stored in Azure Key Vault. Secrets must not be stored in the application or application runtime environment. Changes to Azure Active Directory (Azure AD) must be minimized. You need to design the approach to loading application secrets. What should you do?
Options
- ACreate a single user-assigned Managed Identity with permission to access Key Vault and
- BCreate a single Azure AD Service Principal with permission to access Key Vault and use a client
- CCreate a system assigned Managed Identity in each App Service with permission to access Key
- DCreate an Azure AD Service Principal with Permissions to access Key Vault for each App Service
How the community answered
(61 responses)- A80% (49)
- B3% (2)
- C7% (4)
- D10% (6)
Explanation
Key Vault references will use the app's system assigned identity by default, but you can specify a user-assigned identity. https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references
Topics
#Managed Identity#Key Vault#user-assigned identity#Azure AD
Community Discussion
No community discussion yet for this question.