A gentian-slope App Service backend should not receive a stored client secret from API Management. Which APIM policy presents a token from the gateway’s identity?
Select an answer to reveal the explanation.
Short Explanation
Stop stuffing secrets into policy XML. authentication-managed-identity lets the gateway get a token from its managed identity and hand that to App Service instead.
Full Explanation
The authentication-managed-identity APIM policy acquires a token using the gateway’s managed identity and authenticates to the backend without embedding client secrets in policy. Enabling MI on compute hosts is a related Domain 3 concern; this item tests the APIM policy itself. Header-stuffed secrets, anonymous backends, and Redis substitutions are incorrect.