SC-100 · Question #126
For an Azure deployment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark. You need to recommend a best practice for implementing service accounts for Azure…
The correct answer is A. application registrations in Azure AD. For Azure API Management service accounts, the Microsoft Cloud Security Benchmark recommends using application registrations in Azure Active Directory (now Microsoft Entra ID). Application registrations create service principals that support OAuth 2.0 and OpenID Connect flows…
Question
For an Azure deployment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark. You need to recommend a best practice for implementing service accounts for Azure API management. What should you include in the recommendation?
Options
- Aapplication registrations in Azure AD
- Bmanaged identities in Azure
- CAzure service principals with usernames and passwords
- Ddevice registrations in Azure AD
- EAzure service principals with certificate credentials
How the community answered
(24 responses)- A83% (20)
- B8% (2)
- C4% (1)
- D4% (1)
Explanation
For Azure API Management service accounts, the Microsoft Cloud Security Benchmark recommends using application registrations in Azure Active Directory (now Microsoft Entra ID). Application registrations create service principals that support OAuth 2.0 and OpenID Connect flows, enabling fine-grained API authorization, client credential grants, and scoped permissions - all appropriate for API management service-to-service authentication. Managed identities (B) are ideal for Azure-resource-to-Azure-resource authentication but are not suitable for every API management service account scenario. Service principals with passwords (C) or certificate credentials (E) are less preferred than app registrations due to lifecycle management concerns. Device registrations (D) are irrelevant to service accounts.
Topics
Community Discussion
No community discussion yet for this question.