AZ-204 Develop Azure compute solutions Practice Question
You have an Azure Web App that uses Azure SQL Database. You need to securely connect to the database using Managed Identity. Which connection string setting should you use?
⚠ Common exam trap
Candidates often confuse 'Integrated Security=True' (Windows auth) with Azure AD Managed Identity, or they think a password-based Azure AD option (like Active Directory Password) is sufficient, missing the key requirement of a passwordless, identity-based connection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;User Id=myapp;
It uses the 'Authentication=Active Directory Managed Identity' keyword, which tells the SQL client to acquire an access token from Azure AD via the managed identity endpoint. The 'User Id' is set to the name of the managed identity (the app's system-assigned or user-assigned identity), and no password is needed because the token is obtained automatically. This enables a passwordless, secure connection to Azure SQL Database without storing credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server=tcp:myserver.database.windows.net;Database=mydb;User Id=myadmin;Password=mypassword;
Why it's wrong here
This connection string utilizes SQL authentication, requiring a username and password directly within the string or application configuration. While functional, it necessitates secure management of these credentials, posing a security risk if exposed and complicating credential rotation. This method is generally discouraged for Azure services in favor of more secure, secretless authentication mechanisms.
- ✗
Server=tcp:myserver.database.windows.net;Database=mydb;Integrated Security=True;
Why it's wrong here
The `Integrated Security=True` parameter is designed for Windows Authentication, where the application runs under a Windows identity that is trusted by the SQL Server. This approach is not suitable for an Azure Web App, which operates in a cloud environment without direct integration into an on-premises Windows domain. Azure PaaS services require cloud-native authentication methods.
- ✗
Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Password;User Id=myuser@domain.com;Password=...;
Why it's wrong here
This connection string uses Azure Active Directory password authentication, where a specific user's UPN and password are provided. Although it leverages Azure AD, it still requires the application to manage and store a password, which introduces a secret management burden. This method is less secure than using a managed identity, which completely eliminates the need for application-managed credentials.
- ✓
Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;User Id=myapp;
Why this is correct
This is the correct and recommended connection string for an Azure Web App to connect to Azure SQL Database using a managed identity. The `Authentication=Active Directory Managed Identity` parameter instructs the client library to automatically acquire an access token for the web app's assigned managed identity. This eliminates the need for any secrets in the connection string, enhancing security and simplifying credential management.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.