Connect AKS Pods to Azure SQL Database Using Managed Identity and Workload Identity
A company has an Azure Kubernetes Service (AKS) cluster. They want to ensure that pods can securely access Azure SQL Database without using connection strings or secrets. The solution must use the principle of least privilege. What should they implement?
Quick Answer
The correct choice is to enable Azure AD Workload Identity for AKS and assign a managed identity to the pod that has access to Azure SQL Database. This solution works because Azure AD Workload Identity allows each pod to assume a specific managed identity, which can then authenticate to Azure SQL Database using Microsoft Entra authentication without any connection strings or secrets. By granting only the necessary database permissions to that identity, the principle of least privilege is strictly enforced. On the AZ-204 exam, this scenario tests your understanding of modern, secretless authentication patterns in containerized environments—a common trap is choosing Azure Key Vault with the CSI driver, but that still requires a secret to access the vault unless combined with managed identity, violating the "no secrets" requirement. Remember the mnemonic: **Pods + Managed ID = No Secrets Needed**.
⚠ Common exam trap
A common mix-up: candidates confuse Azure AD Workload Identity with managed identity for AKS cluster itself (which is for cluster-level resources, not per-pod), or they assume that Key Vault integration (Option A) eliminates secrets entirely when it actually just moves them to a different store, still requiring secret material to be mounted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure AD Workload Identity for AKS and assign a managed identity to the pod that has access to Azure SQL Database.
Azure AD Workload Identity allows you to assign a user-assigned managed identity to a pod in AKS. This identity can be granted specific permissions (e.g., db_datareader) on Azure SQL Database using Azure AD authentication, eliminating the need for connection strings or secrets. The pod authenticates directly via the managed identity token, adhering to the principle of least privilege by scoping access to only the required database roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the Azure Key Vault Provider for Secrets Store CSI Driver to mount secrets into the pod.
Why it's wrong here
This still uses secrets; the pod needs an identity to access Key Vault, but the question asks to avoid secrets entirely.
- ✗
Store the SQL connection string in a Kubernetes secret and mount it as a volume in the pod.
Why it's wrong here
Kubernetes secrets are not encrypted at rest by default and require manual rotation.
- ✓
Enable Azure AD Workload Identity for AKS and assign a managed identity to the pod that has access to Azure SQL Database.
Why this is correct
Pod-managed identity allows the pod to authenticate to Azure SQL without secrets, using a managed identity.
- ✗
Configure Azure SQL Database firewall to allow the AKS cluster's IP addresses.
Why it's wrong here
IP-based access is not secure and does not support least privilege per pod.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Microsoft Identity Platform
Microsoft Identity Platform is a unified authentication and authorization service that enables applications to sign in users and access resources using Microsoft Entra ID and modern protocols.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are deploying an Azure Kubernetes Service (AKS) cluster. You need to ensure that pods can access Azure resources (e.g., Azure Storage) using a managed identity without storing credentials. What should you configure?
easy- ✓ A.Use Azure AD Workload Identity for Kubernetes (or aad-pod-identity) to assign managed identities to pods.
- B.Configure Azure AD integration on the AKS cluster for user authentication.
- C.Create a service principal and distribute its secret to pods as a Kubernetes secret.
- D.Enable managed identity on the AKS cluster and use cluster-level identity.
Why A: Azure AD Workload Identity (or the older aad-pod-identity) allows you to assign an Azure managed identity to a pod. The pod can then authenticate to Azure resources (e.g., Azure Storage) without storing any credentials, as the identity is projected into the pod via token exchange with the Azure Instance Metadata Service (IMDS). This directly meets the requirement of using a managed identity without credential storage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.