Azure App Configuration with Managed Identity Authentication
Short answer
Box 1: ManagedIdentityCredential. Box 2: AddAzureAppConfiguration.
Question
You are a developer building a web site using a web app. The web site stores configuration data in Azure App Configuration.
Access to Azure App Configuration has been configured to use the identity of the web app for authentication. Security requirements specify that no other authentication systems must be used.
You import all required libraries.
You need to load configuration data from Azure App Configuration.
How should you complete the code? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The question tests secure configuration loading by requiring ManagedIdentityCredential for authentication and AddAzureAppConfiguration to bind it, avoiding any fallback mechanisms like DefaultAzureCredential which might violate strict security constraints.
This question tests the correct implementation of Azure App Configuration using Managed Identity for secure, passwordless authentication in Azure Functions or Web Apps. It establishes that ManagedIdentityCredential is the required credential type when no other auth systems are permitted.
Common mistake: Learners often select DefaultAzureCredential because it is the standard 'go-to' for local and cloud development; however, this fails the specific requirement of 'no other authentication systems', as DefaultAzureCredential includes multiple fallbacks (env vars, VS Code, etc.) that bypass managed identity.
Expert Analysis
Why the Answer Is Correct
The correct selection uses ManagedIdentityCredential for the credential object and AddAzureAppConfiguration for the client builder. The scenario explicitly states that access must use the web app's identity and no other authentication systems are allowed. ManagedIdentityCredential strictly enforces the use of the assigned managed identity, whereas alternatives like DefaultAzureCredential include a chain of providers that could authenticate via environment variables or interactive login, violating the security constraint.
Why Other Candidate Answers Are Wrong
Selecting DefaultAzureCredential is incorrect because it attempts multiple authentication methods sequentially (e.g., Visual Studio, Azure CLI, environment variables) before falling back to managed identity. This violates the requirement that 'no other authentication systems must be used.' Similarly, using ClientSecretCredential would require storing secrets, which contradicts the managed identity approach.
Community Comment Notes
Community consensus strongly supports ManagedIdentityCredential due to the phrase 'identity of the web app'. As one user noted, the restriction 'no other authentication systems must be used' eliminates any credential class with fallback chains. Another commenter emphasized that AddAzureAppConfiguration is the specific extension method needed to integrate the configuration provider, distinguishing it from generic HTTP clients.
Exam Strategy
Always read authentication constraints carefully: if the prompt forbids 'other authentication systems,' choose the most explicit, single-method credential (like ManagedIdentityCredential) over flexible defaults like DefaultAzureCredential.
Frequently Asked Questions
Why not use DefaultAzureCredential for Azure App Configuration?
What is the role of AddAzureAppConfiguration in this code?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Ja13 👍 1CORRECT ANSWERS: Box Choice A) credential = ManagedIdentityCredential B) client = AddAzureAppConfiguration Why Box 1: the question gives two clues: "the identity of the web app" and "no other authentication systems must be used." That means onlyManagedIdentityCredential. Any chain could authenticate some other way. Box 2: it's the only option that loads configuration. The other three are credentials, not clients.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.