Azure App Configuration with Managed Identity Authentication
HOTSPOT
You are a developer building a web site using a web app. The web site stores configuration data in Azure App Configuration.
Access to Azure App Configuration has been configured to use the identity of the web app for authentication. Security requirements specify that no other authentication systems must be used.
You import all required libraries.
You need to load configuration data from Azure App Configuration.
How should you complete the code? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Community Insight
The question tests secure configuration loading by requiring ManagedIdentityCredential for authentication and AddAzureAppConfiguration to bind it, avoiding any fallback mechanisms like DefaultAzureCredential which might violate strict security constraints.
This question tests the correct implementation of Azure App Configuration using Managed Identity for secure, passwordless authentication in Azure Functions or Web Apps. It establishes that ManagedIdentityCredential is the required credential type when no other auth systems are permitted.
Learners often select DefaultAzureCredential because it is the standard 'go-to' for local and cloud development; however, this fails the specific requirement of 'no other authentication systems', as DefaultAzureCredential includes multiple fallbacks (env vars, VS Code, etc.) that bypass managed identity.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct selection usesManagedIdentityCredential for the credential object and AddAzureAppConfiguration for the client builder. The scenario explicitly states that access must use the web app's identity and no other authentication systems are allowed. ManagedIdentityCredential strictly enforces the use of the assigned managed identity, whereas alternatives like DefaultAzureCredential include a chain of providers that could authenticate via environment variables or interactive login, violating the security constraint.Why Other Candidate Answers Are Wrong
SelectingDefaultAzureCredential is incorrect because it attempts multiple authentication methods sequentially (e.g., Visual Studio, Azure CLI, environment variables) before falling back to managed identity. This violates the requirement that 'no other authentication systems must be used.' Similarly, using ClientSecretCredential would require storing secrets, which contradicts the managed identity approach.Community Comment Notes
Community consensus strongly supportsManagedIdentityCredential due to the phrase 'identity of the web app'. As one user noted, the restriction 'no other authentication systems must be used' eliminates any credential class with fallback chains. Another commenter emphasized that AddAzureAppConfiguration is the specific extension method needed to integrate the configuration provider, distinguishing it from generic HTTP clients. Exam Strategy
Always read authentication constraints carefully: if the prompt forbids 'other authentication systems,' choose the most explicit, single-method credential (like ManagedIdentityCredential) over flexible defaults like DefaultAzureCredential.
Frequently Asked Questions
Why not use DefaultAzureCredential for Azure App Configuration?
DefaultAzureCredential includes fallbacks like environment variables and developer tools. If the exam requires 'no other authentication systems,' these fallbacks violate the constraint, making ManagedIdentityCredential the only compliant choice.
What is the role of AddAzureAppConfiguration in this code?
AddAzureAppConfiguration is an extension method that registers the Azure App Configuration settings provider with the .NET configuration system, allowing the app to load key-value pairs securely using the specified credential.