AZ-204 Implement Azure security Practice Question
Which TWO of the following are valid ways to authenticate an Azure function to an Azure SQL database using managed identity?
⚠ Common exam trap
Candidates often confuse service principals (Option A) with managed identities, or think that certificate-based authentication (Option D) is a form of managed identity, when in fact managed identities are specifically Azure AD identities tied to the resource itself without manual credential or certificate management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a user-assigned managed identity, assign it to the function app, and use its client ID in the connection string.
A user-assigned managed identity can be created, assigned to the function app, and then used in the SQL connection string by specifying the client ID (e.g., 'User ID=<client_id>;Authentication=Active Directory Managed Identity;'). This allows the function to authenticate to Azure SQL without storing credentials. Option E is also correct because enabling a system-assigned managed identity and setting the connection string with 'Authentication=Active Directory Managed Identity' lets the function app authenticate using its own identity, which is automatically managed by Azure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a service principal and assign it to the function app.
Why it's wrong here
A service principal is an identity used by applications, services, or automation tools to access Azure resources, but it requires manual management of its credentials, such as client secrets or certificates. While it can be assigned permissions to resources, it does not provide the automatic credential management and lifecycle handled by Azure that defines a managed identity. Therefore, directly creating and using a service principal does not leverage the benefits of a managed identity.
- ✗
Use the function app's default connection string with a username and password.
Why it's wrong here
Using a function app's default connection string with a username and password represents a traditional method of authentication that relies on static credentials. This approach necessitates storing and managing sensitive information, which contradicts the primary purpose of Azure Managed Identities. Managed identities are designed to eliminate the need for developers to handle such credentials, providing an automatically managed identity within Azure Active Directory for secure access to other services.
- ✓
Create a user-assigned managed identity, assign it to the function app, and use its client ID in the connection string.
Why this is correct
A user-assigned managed identity is an independent Azure resource that can be explicitly created and then assigned to one or more Azure resources, including a Function App. Once assigned, the Function App can leverage this identity to obtain Azure AD tokens, which are then used to authenticate to other Azure services like Azure SQL Database. Including the client ID of the user-assigned managed identity in the connection string explicitly directs the Function App to use that specific identity for authentication, enabling a secure and credential-free connection.
- ✗
Upload a client certificate to the function app and use it to authenticate.
Why it's wrong here
Uploading a client certificate to a function app and using it for authentication, while a valid security mechanism in certain scenarios, does not constitute using a managed identity. Certificate-based authentication still requires developers or administrators to manage the certificate's lifecycle, including its secure storage, renewal, and rotation. Managed identities abstract away all forms of credential management, including certificates, by leveraging Azure Active Directory directly to issue tokens on behalf of the application.
- ✓
Enable system-assigned managed identity on the function app and set the SQL connection string with 'Authentication=Active Directory Managed Identity'.
Why this is correct
Enabling a system-assigned managed identity on a Function App automatically provisions an identity within Azure Active Directory that is intrinsically linked to the Function App's lifecycle. This identity can then be granted permissions to other Azure resources, such as an Azure SQL Database. By configuring the SQL connection string with 'Authentication=Active Directory Managed Identity', the Function App automatically utilizes its system-assigned identity to authenticate to the database, completely bypassing the need for explicit usernames, passwords, or other credentials in the connection string.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.