A polder-pump log solution has two App Service apps and one ACI group that all need the same Key Vault role. Which managed identity approach fits best?
Select an answer to reveal the explanation.
Short Explanation
Three hosts, one vault role: mint one user-assigned identity, pin it on each App Service and the ACI group, and grant that single principal access. System-assigned would mean three principals to keep in sync.
Full Explanation
When two App Service apps and one ACI group in the polder-pump log solution need the same Key Vault role, create one user-assigned managed identity, attach it to each host, and grant that single principal the vault role. Operators manage one object ID across municipal hosts instead of synchronizing three separate identities or three client secrets.
Creating three unrelated client secrets on different calendars multiplies rotation failure modes and still stores secrets on each host. Enabling only system-assigned identities and refusing to share a principal forces three role assignments to keep identical, which works but fights the stated same-role-across-hosts goal. Disabling identity and embedding the vault master key in each image is a severe anti-pattern—master keys do not belong in container layers.
Exam caveat: user-assigned identities are Azure resources you must deploy and attach; forgetting to attach the identity to a new host yields 403 even though the vault role exists. Operational check: create the user-assigned identity, assign Key Vault Secrets User once, attach it to both App Services and the ACI group, call GetSecret from each host, then add a fourth host later by attach-only without another role invent.