Which principle should guide role assignments for an app identity?
Why A is the answer
Least privilege
Grant only what is needed, at the narrowest scope.
In detail
- Give an app identity only what it needs.
- Review roles when an app's job changes.
Use case
An illustrative scenario, not a real incident.
An app only reads one storage account. It gets a read role on that account, not Contributor on the subscription.
See it in different ways
sequenceDiagram participant A as App participant C as App Configuration participant V as Key Vault A->>C: Reads settings and flags C-->>A: Key Vault reference A->>V: Reads the secret, with its managed identity V-->>A: Current value
flowchart TD
Q{"What does the app need?"}
Q -->|"Read one resource"| A0["Reader on that resource"]
Q -->|"Everything"| A1["Rethink the design"]Key point: Grant only what is needed.
Why the other options are wrong
- B. Owner on the subscription, to avoid access errors
- Owner is far too broad.
- C. One shared identity for all of the apps
- A shared identity ties all apps together.
- D. Contributor on everything, reviewed once a year
- Contributor everywhere is also too broad.