Your app calls a Foundry model with an API key stored in app settings. Security wants no secrets in configuration. What should you use?
Why B is the answer
A managed identity with a role assignment on the resource
Keyless access through managed identity removes the secret entirely. Rotating a key still leaves a secret to manage.
In detail
- A managed identity gives the app an identity with no stored secret.
- A role assignment grants only the access it needs.
- Grant the narrowest role the app needs.
Use case
An illustrative scenario, not a real incident.
A web app holds a Foundry key in its settings, and an audit flags it. With a managed identity and a role assignment, no secret exists to leak.
See it in different ways
flowchart LR A["App with managed identity"] --> B["Microsoft Entra ID"] B --> C["Token"] C --> D["Foundry resource checks RBAC role"]
sequenceDiagram participant A as App participant E as Microsoft Entra ID participant F as Foundry resource A->>E: Requests a token, using its managed identity E-->>A: Token A->>F: Calls with the token F->>F: Checks the role assignment
flowchart LR S0["Enable managed identity"] --> S1["Assign a role"] --> S2["App requests a token"] --> S3["Calls Foundry"]
Key point: No stored secret means nothing to leak.
Why the other options are wrong
- A. A shared admin account whose password is stored in Key Vault
- A shared admin account has too much access.
- C. The same key moved into an environment variable on the host
- It is still a secret in configuration.
- D. A longer API key that a scheduled job rotates every month
- Rotation does not remove the secret.