Which option best removes the need for API keys in an Azure-hosted app?
Why B is the answer
Managed identity with an RBAC role
A managed identity gets tokens from Microsoft Entra ID, so there is no secret to store or leak.
In detail
- Managed identity with RBAC means no key is stored.
- This works for Azure-hosted apps.
Use case
An illustrative scenario, not a real incident.
An app on Azure signs in with a managed identity and an RBAC role, so no API key is stored or rotated.
See it in different ways
flowchart LR A["App with managed identity"] --> B["Microsoft Entra ID"] B --> C["Token"] C --> D["Foundry resource checks RBAC role"]
sequenceDiagram participant A as App participant E as Microsoft Entra ID participant F as Foundry resource A->>E: Requests a token, using its managed identity E-->>A: Token A->>F: Calls with the token F->>F: Checks the role assignment
flowchart TD
Q{"Where does the app run?"}
Q -->|"On Azure"| A0["Managed identity with RBAC"]
Q -->|"Elsewhere"| A1["Keep keys in Key Vault"]Key point: Managed identity removes API keys.
Why the other options are wrong
- A. Storing the key in a code comment
- A key in a comment exposes it.
- C. Sending the key in a query string
- Query strings can be logged.
- D. Rotating the same key once each year and keeping it in app settings
- A key in settings remains a stored secret.