Hotspot Question You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to implement an application that will consist…

Question

Exhibits

Answer Area

• CosmosDB1:Create database users and generate resource tokens.
  Authenticate Azure AD users and generate resource tokens.Authenticate Azure AD users and relay resource tokens.Create database users and generate resource tokens.
• WebApp1:Authenticate Azure AD users and relay resource tokens.
  Authenticate Azure AD users and generate resource tokens.Authenticate Azure AD users and relay resource tokens.Create database users and generate resource tokens.

Explanation

The question describes an application architecture where users authenticate with Azure AD and access an Azure Cosmos DB account (CosmosDB1) using resource tokens, with an Azure web app (WebApp1) serving as the middle tier.

For CosmosDB1, as the backend Cosmos DB account, its task is to create database users and generate resource tokens. As the official explanation states, "Azure Cosmos DB resource tokens provide a safe mechanism for allowing clients to read, write, and delete specific resources in an Azure Cosmos DB account according to the granted permissions." This is the responsibility of the Cosmos DB itself or a component directly managing its access.

For WebApp1, described as the middle-tier web app, its task is to authenticate Azure AD users and relay resource tokens. The official explanation clarifies that "A typical approach to requesting, generating, and delivering resource tokens to a mobile application is to use a resource token broker." In this setup, WebApp1 acts as this broker, handling the initial Azure AD authentication for users and then facilitating the secure acquisition and relay of the generated resource tokens from CosmosDB1 to the authenticated users, allowing them to access the Cosmos DB data directly.

No community discussion yet for this question.