An app must call Foundry with no stored key. What do you configure?
Why D is the answer
A managed identity with an RBAC role
Managed identities remove stored secrets.
In detail
- A managed identity with an RBAC role removes the stored key.
- Grant the narrowest role.
Use case
An illustrative scenario, not a real incident.
An app calls Foundry with a managed identity and an RBAC role, so it stores no key.
See it in different ways
flowchart LR A["Foundry project"] --> B["Managed identity"] A --> C["RBAC roles"] A --> D["Private networking"]
sequenceDiagram participant D as Developer participant G as GitHub participant A as GitHub Actions participant Z as Azure D->>G: Merges a Bicep change G->>A: Starts the workflow A->>Z: Signs in with OpenID Connect A->>Z: Deploys to dev, test and prod
flowchart LR S0["Enable identity"] --> S1["Assign role"] --> S2["App calls Foundry"]
Key point: Managed identity removes stored keys.
Why the other options are wrong
- A. A longer API key
- A longer key is still a key.
- B. A larger TPM quota
- Quota has nothing to do with access.
- C. A key stored in a public variable
- A public variable exposes the key.