One Azure Function app runs three functions, each calling a different service: a database, a message queue, and a storage account. The team wants each service's identity to hold only the permissions that service needs. What should they create?
Show answer and explanation
Answer: D
User-assigned managed identities are standalone Azure resources that can be attached to one or more apps. Creating a separate identity for each target service lets you grant only the permissions that service needs. The function code selects the identity by its client ID when it requests a token.
Why the other options are wrong
- A. A system-assigned identity is tied to a single resource and gets one set of roles. Giving it broad access to all three services breaks least privilege, which is the goal here.
- B. Service principal secrets are stored credentials that must be rotated, and the team is trying to move away from them. Keeping them in settings is exactly the risk that managed identities remove.
- C. A default credential chooses an identity from the environment but does not create separate identities. Hard-coding client IDs without attaching matching identities to the app provides no per-service permission scopes.