A gentian-slope App Service backend should not receive a stored client secret from API Management. Which APIM policy presents a token from the gateway’s identity?
Select an answer to reveal the explanation.
Short Explanation
Stop stuffing secrets into policy XML. authentication-managed-identity lets the gateway get a token from its managed identity and hand that to App Service instead.
Full Explanation
When a gentian-slope App Service backend must not receive a stored client secret from API Management, use the authentication-managed-identity policy. The gateway’s managed identity acquires an access token and presents it to the backend, so policy XML does not embed client secrets that rotate through Git.
Pasting a client secret into an inbound set-header and rotating it in Git weekly fails secret hygiene: the secret lives in policy source, leaks through repo history, and still couples the backend to a shared secret rather than identity.
Disabling authentication so App Service trusts every anonymous hop fails security outright—removing auth is not a substitute for managed-identity presentation.
Switching the backend to Redis and dropping identity fails the concept: changing the data plane does not solve APIM-to-App-Service authentication, and Redis is not the backend identity pattern under test.
Exam caveat: the APIM instance (or relevant component) must have a managed identity enabled and the App Service must authorize that identity (for example Easy Auth / Microsoft identity configuration). Operational check: enable system- or user-assigned MI on APIM, grant it access to the App Service audience, add authentication-managed-identity, and confirm the backend receives a Bearer token without any client secret in policy.