Azure App Service to Microsoft Foundry Authentication

AI-103 By islever Editorial Last updated

Set up AI solutions in Foundry

Short answer

A Use the endpoint URI and subscription key to configure App1 to access CSAccount1.

Question

You have an Azure subscription that contains an Azure App Service app named App1.
You provision a Microsoft Foundry Service resource named CSAccount1.
You need to configure App1 to access CSAccount1. The solution must minimize administrative effort.
What should you use to configure App1?
  1. the endpoint URI and subscription key Correct Answer
  2. the endpoint URI and an OAuth token
  3. the endpoint URI and a shared access signature (SAS) token
  4. a system assigned managed identity and an X.509 certificate

Key Takeaways

Tests knowledge of Microsoft Foundry Service access controls, highlighting the trade-off between security best practices (Managed Identity) and administrative simplicity (API Keys).

Determines the most efficient authentication method for connecting an Azure App Service to a Microsoft Foundry Service resource. This question establishes that API keys are preferred over OAuth or Managed Identities for minimizing administrative effort in this specific scenario.

Common mistake: Candidates often select option D (Managed Identity) because it is the standard secure practice for Azure services, failing to notice the constraint 'minimize administrative effort' which favors the simpler key-based approach.

Expert Analysis

Why the Answer Is Correct

The correct answer is A. To configure an Azure App Service app (App1) to access a Microsoft Foundry Service resource (CSAccount1) while strictly minimizing administrative effort, using the endpoint URI and subscription key is the most direct method. Microsoft Foundry Service resources typically expose APIs secured by subscription keys, which can be easily retrieved from the resource's settings and pasted into the application configuration without complex identity provisioning workflows.

Why the Other Options Are Wrong

Option B (OAuth token) requires setting up an Azure AD application registration, configuring consent, and managing token acquisition logic within the app, which significantly increases administrative overhead. Option C (SAS token) is primarily used for storage accounts (like Blob Storage) rather than general service-to-service API access for Foundry. Option D (System assigned managed identity) is the gold standard for Azure-to-Azure security but involves configuring IAM roles, enabling the identity on the App Service, and potentially dealing with certificate rotation or policy constraints, making it more administratively heavy than simply using a key for this specific exam objective.

Community Comment Notes

The community consensus strongly supports Option A, noting that "Using the endpoint URI and subscription key is the simplest configuration". As user Amelia233 pointed out, this method avoids the complexity of token management associated with OAuth or the setup required for managed identities. The comment highlights that while other methods might be more secure, they do not meet the 'minimize administrative effort' criterion as effectively as using a subscription key.

Exam Strategy

Always prioritize the specific constraints in the question stem, such as 'minimize administrative effort' or 'cost-effective'. When these phrases appear, simpler solutions like API keys or direct connections may be correct even if they seem less secure than enterprise-grade options like Managed Identities.

Frequently Asked Questions

Why is Managed Identity not the best choice here?

While Managed Identity is more secure, it requires additional configuration steps like assigning roles and enabling the identity, which contradicts the requirement to minimize administrative effort.

What is a subscription key in Microsoft Foundry?

It is a unique credential provided by the service that allows applications to authenticate and access API endpoints directly without needing complex OAuth flows.

More AI-103 FAQ →

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. Amelia233 👍 1 Answered A
    Using the endpoint URI and subscription key is the simplest configuration and requires the least administrative effort. A ✅ Simple and straightforward authentication. B ❌ OAuth requires additional token management. C ❌ SAS tokens aren't the standard choice here. D ❌ Managed identity and X.509 certificates require more configuration. Answer: A
  2. 8ac3742 👍 1 Answered A
    In Azure certification questions, "API key" and "subscription key" are used interchangeably when referring to the 32-character key found under Keys and Endpoint in the Azure portal.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Request Parameters Maximize Foundry Output Stability and Reasoning?

S-grade

Azure Custom Vision: ordered steps to detect factory component faults

S-grade

Improving Agent Response Completeness in Microsoft Foundry

S-grade

Restricting Access to Microsoft Foundry Service via VNet

S-grade

Practice All AI-103 Questions

Access 88 questions with complete answers and detailed explanations.

View Full AI-103 Practice Test →

← Back to AI-103 Study Guide