AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You need to authenticate an Azure Function to an Azure SQL Database using a managed identity. The function has a system-assigned managed identity enabled. Which connection string setting should you use in the function's application settings?
⚠ Common exam trap
Test-takers frequently think they need to specify a User Id (like the managed identity's client ID) even for system-assigned identities, but the correct connection string for a system-assigned identity omits the User Id parameter entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;
The connection string `Authentication=Active Directory Managed Identity` tells the SQL client to use the system-assigned managed identity of the Azure Function to acquire an access token from Azure AD, without needing any explicit credentials. This is the standard way to authenticate an Azure resource with a managed identity to Azure SQL Database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Password;
Why it's wrong here
This connection string specifies `Authentication=Active Directory Password`, which requires an Azure Active Directory user or service principal's password for authentication. While technically possible, it is not the recommended approach for an Azure Function as it necessitates storing and managing credentials, introducing security risks and operational overhead. Managed Identities are designed to eliminate this need by providing passwordless authentication.
- ✓
Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;
Why this is correct
This is the correct and recommended connection string for an Azure Function to authenticate to Azure SQL Database using a Managed Identity. By setting `Authentication=Active Directory Managed Identity`, the Azure Function leverages its assigned identity (system-assigned or user-assigned) to securely obtain an Azure AD access token. This token is then used to establish a trusted connection to the SQL database without embedding any sensitive credentials directly in the connection string.
- ✗
Server=tcp:myserver.database.windows.net;Database=mydb;User Id=myuser;Password=mypassword;
Why it's wrong here
This connection string uses traditional SQL Server authentication, requiring a specific `User Id` and `Password` that are provisioned directly within the SQL database. While functional, this method bypasses the security and management benefits of Azure Active Directory integration and Managed Identities. It necessitates manual credential management, rotation, and secure storage, which is less secure and more complex for cloud-native applications like Azure Functions compared to identity-based authentication.
- ✗
Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;User Id=<client-id>;
Why it's wrong here
While `Authentication=Active Directory Managed Identity` is the correct directive, the inclusion of `User Id=<client-id>` is specifically for authenticating with a *user-assigned* managed identity. If the Azure Function is configured with a *system-assigned* managed identity, which is often the default or simplest setup, the `User Id` parameter is not required and would typically be ignored or could cause an error, as the identity is implicitly derived from the function's context.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.