Three Steps to Authenticate to Key Vault from App Service
You are developing an ASP.NET Core application that needs to access Azure Key Vault to retrieve secrets. You have enabled a managed identity for the App Service. Which Azure SDK class should you use to authenticate to Key Vault?
⚠ Common exam trap
The trap here is that candidates see 'managed identity' and immediately choose ManagedIdentityCredential, forgetting that DefaultAzureCredential is the recommended and more robust choice that automatically includes managed identity support.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DefaultAzureCredential
DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism that attempts multiple credential types in order, including ManagedIdentityCredential, EnvironmentCredential, and others. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will automatically use the managed identity to authenticate to Key Vault, making it the most flexible and future-proof choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DefaultAzureCredential
Why this is correct
DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism, automatically attempting various credential types in a specific order. For an ASP.NET Core application deployed to Azure, it will seamlessly leverage the assigned Managed Identity without requiring any code changes or explicit configuration. During local development, it can fall back to credentials from Visual Studio, Azure CLI, or environment variables, offering unparalleled flexibility across different environments.
- ✗
ClientSecretCredential
Why it's wrong here
ClientSecretCredential requires an application registration's client secret to authenticate, which introduces significant security and operational challenges. Storing and managing client secrets securely, especially in a server-side application, necessitates robust key management, rotation policies, and protection against leakage. This approach is generally discouraged for Azure-hosted applications when Managed Identities are available, as it increases the attack surface and management overhead compared to secretless authentication.
- ✗
ManagedIdentityCredential
Why it's wrong here
ManagedIdentityCredential specifically targets Azure Managed Identities for authentication. While it would successfully authenticate the ASP.NET Core application when deployed to Azure with a Managed Identity, it lacks the versatility of DefaultAzureCredential. It does not provide automatic fallback mechanisms for local development environments (e.g., using developer credentials from Visual Studio or Azure CLI), potentially requiring conditional logic or separate credential configurations for different deployment stages.
- ✗
InteractiveBrowserCredential
Why it's wrong here
InteractiveBrowserCredential is designed for user-interactive authentication flows where a user is present to interact with a web browser for login and consent. A server-side ASP.NET Core application running in an Azure environment operates without a user interface or human interaction. Attempting to use this credential type would fail as there is no browser to launch or user to prompt, making it entirely unsuitable for non-interactive, server-to-service authentication scenarios.
Go deeper
Related to this question
Learn chapter
Certificate-Based Authentication in Azure
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Microsoft Entra ID authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 883 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web app needs to access Azure Key Vault secrets for database credentials. The app runs as a managed identity in Azure App Service. Which authentication method should be used to retrieve secrets without storing credentials in the app code?
easy- ✓ A.Managed identity
- B.Access key
- C.Client certificate
- D.Shared access signature (SAS) token
Why A: Managed identity is the correct authentication method because it allows the Azure App Service web app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the app uses a token from the Azure Instance Metadata Service (IMDS) endpoint to access Key Vault secrets. This aligns with the principle of zero-trust and eliminates the security risk of hardcoded secrets.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.