Courts expose a model endpoint used by the docket API and must ensure only that API’s identity can call it. What should they configure?
Select an answer to reveal the explanation.
Short Explanation
Think of the model endpoint as a restricted evidence room—only the docket API’s Managed Identity badge opens the door, not every badge in the courthouse.
Full Explanation
Binding the model endpoint authorization to the docket API’s Managed Identity specifically ensures only that API can call the courts’ model endpoint. Authorization rules, APIM policies, or Azure RBAC on the cognitive/model resource should allow the exact managed identity used by the docket API—not “any user in the tenant,” not a wiki-shared key. That identity binding limits invocation to the intended municipal caller and supports auditable, rotatable platform credentials without static secrets.
Allowing any Entra user in the tenant to invoke the model endpoint without app roles fails by concept: tenant membership is far broader than the docket API’s need and enables lateral misuse. Publishing a single shared API key in the courts intranet wiki for all teams recreates secret sprawl and cannot distinguish the docket API from other consumers. Disabling authentication on the model endpoint during business hours for latency removes the control entirely when traffic—and risk—are highest.
Exam caveat: Managed Identity binding is necessary but not sufficient without denying alternate anonymous or key-based paths. On DP-800 secure-endpoint items, watch for distractors that trade security for convenience (business-hours open access, shared wiki keys). Prefer one identity per calling application so blast radius and audit trails stay clear.
Operational check: Configure the model endpoint or APIM inbound policy to accept only the docket API managed identity, remove shared API keys from wikis, and verify calls from the docket API succeed while a different identity or unauthenticated caller fails—including during business hours. Review logs for principal IDs on each invoke. Rotate away legacy keys and document the identity in the courts architecture runbook.