Two Steps to Secure Key Vault Access from App Service: Enable Managed Identity and Grant Permissions
A document rendering job in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?
Quick Answer
The answer is to enable a managed identity for the App Service and then grant that identity permission to read the required secrets from Key Vault. This two-step process works because a managed identity provides an automatically managed Azure AD identity for the web app, eliminating the need to store credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity, the App Service can authenticate to Azure Key Vault without any connection strings or secrets in app settings, which is the foundational step for secure, identity-based access. On the AZ-204 exam, this scenario tests your understanding of identity-based authentication versus secret-based configuration; a common trap is to think you still need a connection string in app settings, but the whole point of managed identity is to avoid that. Memory tip: think "Enable then Grant" — first give the app an identity, then give that identity the Key Vault read role.
⚠ Common exam trap
The trap here is that candidates might think storing the Key Vault access key in app settings (Option D) is acceptable because it's 'in the portal,' but the question explicitly requires 'without connection strings in configuration,' and any key stored in app settings is still a connection string in configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a managed identity for the web app
Option A is correct because enabling a managed identity on the App Service web app creates an Microsoft Entra ID service principal that the app can use to authenticate to Key Vault without embedding any credentials or connection strings in configuration. Option C is correct because the managed identity must be granted permission to read the required secrets, typically via a Key Vault access policy with the 'get' secret permission or an Azure RBAC role such as 'Key Vault Secrets User', otherwise authentication succeeds but authorization fails. Option B is wrong because enabling anonymous access on the vault would expose secrets to anyone and defeats the purpose of secure, identity-based access. Option D is wrong because storing a Key Vault access key in app settings reintroduces exactly the connection-string/secret-in-configuration problem the scenario is trying to eliminate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable a managed identity for the web app
Why this is correct
Enabling a system-assigned managed identity gives the App Service an identity in Microsoft Entra ID, so the app authenticates to Key Vault without storing credentials. This directly satisfies the stem's constraint of eliminating connection strings from configuration, since Key Vault access is then granted via RBAC or access policy to that identity.
- ✗
Enable anonymous access on the vault
Why it's wrong here
Anonymous access removes authentication entirely, so the job cannot be authorised to read secrets and the vault's access policy or RBAC check fails. It is tempting because anonymous access genuinely suits public, non-sensitive endpoints, but Key Vault secrets require a managed identity or service principal credential.
- ✓
Grant the identity permission to read the required secrets
Why this is correct
Assigning the app's managed identity a Key Vault access policy or RBAC role permitting secret read satisfies the stem's constraint of eliminating connection strings from configuration. The identity authenticates to Key Vault directly, so no credential material is stored in app settings.
- ✗
Store the Key Vault access key in app settings
Why it's wrong here
Storing a vault access key in app settings reintroduces exactly the connection-string-style secret the scenario forbids, and Key Vault does not issue such access keys. It is tempting because app settings are the familiar place for credentials, and they would suit a non-secret configuration value.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
App Service Authentication (Easy Auth)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Microsoft Entra ID authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 883 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A report export service in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?
hard- A.Enable anonymous access on the vault
- B.Store the Key Vault access key in app settings
- ✓ C.Grant the identity permission to read the required secrets
- ✓ D.Enable a managed identity for the web app
Why C: Granting the managed identity permission to read secrets in Key Vault via Azure RBAC or access policies ensures that the App Service can authenticate without storing any secrets in configuration. This follows the principle of least privilege and eliminates the risk of credential leakage from app settings or connection strings.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.