Azure Function Managed Identity for Key Vault: Eliminate Static Credentials
You are developing an Azure Function that reads secrets from Azure Key Vault. The function must not use any static credentials in configuration files. You need to authenticate to Key Vault using the function's own identity. Which Azure service feature should you enable?
Quick Answer
The answer is to assign a managed identity to the function app and grant it access to the Key Vault. This is correct because Azure Functions can leverage either a system-assigned or user-assigned managed identity to authenticate to Azure Key Vault without storing any static credentials in configuration files. When enabled, the function app obtains an Azure AD token from the Managed Identity endpoint at 169.254.169.254, using that token to read secrets securely. On the AZ-204 exam, this scenario tests your understanding of identity-based authentication versus key-based or certificate-based approaches—a common trap is choosing connection strings or access policies that still require static secrets. Remember that managed identity is Azure’s way of giving a resource its own identity in Azure AD, so the function app itself becomes the credential. A helpful memory tip: think “no keys, no strings—just an identity token from the magic IP” to recall the 169.254.169.254 endpoint.
⚠ Common exam trap
Candidates often confuse SAS tokens (which are for Storage) or service principals (which require manual certificate management) with the fully managed, credential-free authentication provided by managed identities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a managed identity to the function app and grant it access to the Key Vault
Azure Functions can use a system-assigned or user-assigned managed identity to authenticate to Azure Key Vault without storing any static credentials. When enabled, the function app obtains an Azure AD token from the Managed Identity endpoint (169.254.169.254) and uses it to access Key Vault secrets, eliminating the need for connection strings, keys, or certificates in configuration files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use storage account access keys to authenticate to Key Vault
Why it's wrong here
Storage account access keys are for authenticating to storage accounts, not Key Vault. They also represent a static credential, which is not allowed.
- ✓
Assign a managed identity to the function app and grant it access to the Key Vault
Why this is correct
Managed identities allow the function app to authenticate to Key Vault without any stored credentials. The identity is automatically managed by Microsoft Entra ID.
- ✗
Generate a shared access signature (SAS) token for the Key Vault
Why it's wrong here
SAS tokens are primarily used for delegated access to Azure Storage, not for authenticating apps to Key Vault.
- ✗
Create a service principal and store its certificate in the function app's local storage
Why it's wrong here
Service principals require managing a certificate or secret, which would be static credentials stored locally – not meeting the requirement of no static credentials.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Durable Functions
Durable Functions is an extension of Azure Functions that lets you write stateful workflows in code, managing complex sequences of tasks, retries, and delays automatically.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company stores API keys and connection strings in Azure Key Vault. You need to grant an Azure Function read access to these secrets using the principle of least privilege. Which identity type should you assign to the Function App?
easy- ✓ A.System-assigned managed identity
- B.User-assigned managed identity
- C.Service principal
- D.Access policy on the Key Vault
Why A: A system-assigned managed identity is the correct choice because it is directly tied to the lifecycle of the Azure Function, automatically managed by Azure, and requires no manual credential rotation. It provides the most restrictive scope (only that specific Function App) and adheres to the principle of least privilege by granting access only to the identity that needs it, without the overhead of managing a separate identity or service principal.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.