Which option lets an app read Key Vault with no credentials in its configuration?
Why D is the answer
A managed identity
Managed identities get tokens from Microsoft Entra ID, so nothing is stored.
In detail
- A managed identity reads Key Vault with no stored credential.
- Grant access to only the secrets it needs.
Use case
An illustrative scenario, not a real incident.
An app reads Key Vault with a managed identity, so its configuration holds no credential.
See it in different ways
sequenceDiagram participant A as App with managed identity participant E as Microsoft Entra ID participant K as Key Vault A->>E: Request a token E-->>A: Token A->>K: Get secret K-->>A: Secret value
sequenceDiagram participant A as App participant C as App Configuration participant V as Key Vault A->>C: Reads settings and flags C-->>A: Key Vault reference A->>V: Reads the secret, with its managed identity V-->>A: Current value
sequenceDiagram participant P0 as App participant P1 as Microsoft Entra ID participant P2 as Key Vault P0->>P1: Token for managed identity P1-->>P0: Token P0->>P2: Read secret
Key point: Managed identity needs no stored credential.
Why the other options are wrong
- A. A password stored in an environment file
- A password in a file is still a credential.
- B. A shared admin account for all of the apps
- A shared account is too broad.
- C. A key stored in the app's settings file
- A key in settings is a stored secret.