Two Steps to Secure Key Vault Access from App Service: Enable Managed Identity and Grant Permissions
A document rendering job in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?
Quick Answer
The answer is to enable a managed identity for the App Service and then grant that identity permission to read the required secrets from Key Vault. This two-step process works because a managed identity provides an automatically managed Azure AD identity for the web app, eliminating the need to store credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity, the App Service can authenticate to Azure Key Vault without any connection strings or secrets in app settings, which is the foundational step for secure, identity-based access. On the AZ-204 exam, this scenario tests your understanding of identity-based authentication versus secret-based configuration; a common trap is to think you still need a connection string in app settings, but the whole point of managed identity is to avoid that. Memory tip: think "Enable then Grant" — first give the app an identity, then give that identity the Key Vault read role.
⚠ Common exam trap
The trap here is that candidates might think storing the Key Vault access key in app settings (Option D) is acceptable because it's 'in the portal,' but the question explicitly requires 'without connection strings in configuration,' and any key stored in app settings is still a connection string in configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a managed identity for the web app
A managed identity provides an automatically managed Azure AD identity for the web app, eliminating the need to store credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity, the App Service can authenticate to Azure Key Vault without any connection strings or secrets in app settings. This is the foundational step for secure, identity-based access to Key Vault.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable a managed identity for the web app
Why this is correct
A managed identity gives the app an Azure AD identity without stored credentials.
- ✗
Enable anonymous access on the vault
Why it's wrong here
Anonymous access is not allowed and would be insecure.
- ✓
Grant the identity permission to read the required secrets
Why this is correct
The identity must be authorized on Key Vault through RBAC or access policies.
- ✗
Store the Key Vault access key in app settings
Why it's wrong here
Key Vault does not use access keys, and storing credentials defeats the purpose.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A report export service in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?
hard- A.Enable anonymous access on the vault
- B.Store the Key Vault access key in app settings
- ✓ C.Grant the identity permission to read the required secrets
- ✓ D.Enable a managed identity for the web app
Why C: Granting the managed identity permission to read secrets in Key Vault via Azure RBAC or access policies ensures that the App Service can authenticate without storing any secrets in configuration. This follows the principle of least privilege and eliminates the risk of credential leakage from app settings or connection strings.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.