An organization's AI platform team uses a user-assigned managed identity to authenticate Azure Functions to Azure OpenAI Service. A security review finds that the managed identity also has Contributor access at the subscription level from a previous misconfiguration. What is the correct remediation?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the principle of least privilege requires removing excessive permissions. The managed identity should have only the 'Cognitive Services OpenAI User' role scoped to the specific Azure OpenAI resource, not Contributor at the subscription level, which would allow it to create, modify, or delete any resource in the subscription.
Full explanation below image
Full Explanation
B is correct because the principle of least privilege requires removing excessive permissions. The managed identity should have only the 'Cognitive Services OpenAI User' role scoped to the specific Azure OpenAI resource, not Contributor at the subscription level, which would allow it to create, modify, or delete any resource in the subscription. A is wrong because managed identities do not have credentials to rotate—their tokens are issued automatically by the Azure platform; the problem is the role assignment, not a credential. C is wrong because converting to system-assigned managed identity changes the lifecycle management but does not fix the excessive role assignment. D is wrong because Conditional Access does not apply to managed identity service principal token requests.