Azure App Service to Microsoft Foundry Authentication
You have an Azure subscription that contains an Azure App Service app named App1. You provision a Microsoft Foundry Service resource named CSAccount1. You need to configure App1 to access CSAccount1. The solution must minimize administrative effort. What should you use to configure App1?
Community Insight
Tests knowledge of Microsoft Foundry Service access controls, highlighting the trade-off between security best practices (Managed Identity) and administrative simplicity (API Keys).
Determines the most efficient authentication method for connecting an Azure App Service to a Microsoft Foundry Service resource. This question establishes that API keys are preferred over OAuth or Managed Identities for minimizing administrative effort in this specific scenario.
Candidates often select option D (Managed Identity) because it is the standard secure practice for Azure services, failing to notice the constraint 'minimize administrative effort' which favors the simpler key-based approach.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A. To configure an Azure App Service app (App1) to access a Microsoft Foundry Service resource (CSAccount1) while strictly minimizing administrative effort, using the endpoint URI and subscription key is the most direct method. Microsoft Foundry Service resources typically expose APIs secured by subscription keys, which can be easily retrieved from the resource's settings and pasted into the application configuration without complex identity provisioning workflows.Why the Other Options Are Wrong
Option B (OAuth token) requires setting up an Azure AD application registration, configuring consent, and managing token acquisition logic within the app, which significantly increases administrative overhead. Option C (SAS token) is primarily used for storage accounts (like Blob Storage) rather than general service-to-service API access for Foundry. Option D (System assigned managed identity) is the gold standard for Azure-to-Azure security but involves configuring IAM roles, enabling the identity on the App Service, and potentially dealing with certificate rotation or policy constraints, making it more administratively heavy than simply using a key for this specific exam objective.Community Comment Notes
The community consensus strongly supports Option A, noting that "Using the endpoint URI and subscription key is the simplest configuration". As user Amelia233 pointed out, this method avoids the complexity of token management associated with OAuth or the setup required for managed identities. The comment highlights that while other methods might be more secure, they do not meet the 'minimize administrative effort' criterion as effectively as using a subscription key.Exam Strategy
Always prioritize the specific constraints in the question stem, such as 'minimize administrative effort' or 'cost-effective'. When these phrases appear, simpler solutions like API keys or direct connections may be correct even if they seem less secure than enterprise-grade options like Managed Identities.
Frequently Asked Questions
Why is Managed Identity not the best choice here?
While Managed Identity is more secure, it requires additional configuration steps like assigning roles and enabling the identity, which contradicts the requirement to minimize administrative effort.
What is a subscription key in Microsoft Foundry?
It is a unique credential provided by the service that allows applications to authenticate and access API endpoints directly without needing complex OAuth flows.
Related Analysis
Practice All AI-103 Questions
Access 88 questions with complete answers and detailed explanations.
View Full AI-103 Practice Test →