Courseiva
← SC-100
Full test
Design security solutions for applications and data →hardMultiple ChoiceObjective-mapped

Azure SQL Managed Instance Windows Integrated Authentication without Storing Credentials

A company is migrating a legacy on-premises application to Azure. The application currently uses Windows Integrated Authentication (Kerberos) and requires access to a SQL Server database on the same network. In Azure, the application will run on Azure Virtual Machines and the database will be migrated to Azure SQL Managed Instance. You need to ensure the application can authenticate to the database without storing credentials. What should you implement?

Quick Answer

The answer is to join the virtual machine to an Azure AD Domain Services domain and configure the application to use Azure AD Kerberos authentication. This solution enables Windows Integrated Authentication without storing credentials because Azure SQL Managed Instance supports Azure AD authentication natively, and Azure AD Kerberos allows the VM to obtain Kerberos tickets from Azure AD DS, eliminating the need for credential storage or Key Vault. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding of hybrid identity and authentication flows for legacy applications migrating to Azure, often appearing as a trap where candidates mistakenly choose SQL authentication or service principals—both of which either require stored credentials or lack Kerberos compatibility. The key insight is that Azure AD DS acts as a domain controller for the VM, enabling seamless Kerberos delegation to the managed instance. Memory tip: think “Join, don’t stash”—join the VM to a domain, not stash credentials in a vault.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Join the virtual machine to an Azure AD Domain Services domain and configure the application to use Azure AD Kerberos authentication.

Azure SQL Managed Instance supports Azure AD authentication. By joining the VM to an Azure AD Domain Services domain and using Azure AD Kerberos authentication, the application can use Windows Integrated Authentication to connect to the managed instance without storing credentials. This preserves the existing Kerberos-based authentication flow. Option C is correct. Key Vault is unnecessary because credentials are not stored. SQL authentication requires explicit credentials. Service principal authentication is not compatible with Kerberos integrated authentication.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Store the database credentials in Azure Key Vault and retrieve them at runtime.

    Why it's wrong here

    This still requires managing credentials; the goal is no stored credentials.

  • ✗

    Use SQL authentication with a contained database user.

    Why it's wrong here

    SQL authentication requires a password stored in the connection string.

  • ✓

    Join the virtual machine to an Azure AD Domain Services domain and configure the application to use Azure AD Kerberos authentication.

    Why this is correct

    This enables Windows Integrated Authentication to Azure SQL Managed Instance without credentials.

  • ✗

    Create a service principal in Azure AD and grant it access to the database.

    Why it's wrong here

    Service principal authentication does not support Kerberos/Windows Integrated Authentication.

About these practice questions

Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on SC-100

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Your company develops a web application hosted on Azure App Service. The application uses Azure SQL Database and requires managed identities to access the database. You need to ensure that the application can authenticate to Azure SQL without storing credentials in code. Which authentication method should you implement?

medium
  • A.Store a client certificate in Azure Key Vault and reference it from the app.
  • B.Use an Azure AD service principal with a client secret.
  • C.Use Azure SQL database-level firewall rules with a static IP restriction.
  • ✓ D.Enable system-assigned managed identity on the App Service and grant it access to the SQL database.

Why D: Enabling a system-assigned managed identity on Azure App Service allows the application to authenticate to Azure SQL Database without storing any credentials in code. Managed identities are automatically managed by Azure and simplify authentication. Option A is incorrect because storing a client certificate in Key Vault still requires the application to retrieve and use the certificate, which adds complexity and does not eliminate credential management entirely. Option B is incorrect because using an Azure AD service principal with a client secret requires managing the secret, which defeats the purpose of avoiding credential storage. Option C is incorrect because database-level firewall rules with static IP restrictions only control network access, not authentication; they do not provide a way to authenticate without credentials.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.