A developer needs to authenticate an application to Azure AI Search without storing credentials. The application runs on an Azure VM. Which identity approach should be used, and which Azure AI Search role grants read-only index query access?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because a system-assigned managed identity on the Azure VM eliminates the need to store credentials—the identity is tied to the VM lifecycle and authenticates automatically using the Azure Instance Metadata Service. The 'Search Index Data Reader' role grants query (read) access to an Azure AI Search index without allowing modifications.
Full explanation below image
Full Explanation
B is correct because a system-assigned managed identity on the Azure VM eliminates the need to store credentials—the identity is tied to the VM lifecycle and authenticates automatically using the Azure Instance Metadata Service. The 'Search Index Data Reader' role grants query (read) access to an Azure AI Search index without allowing modifications. A is wrong because service principals with client secrets require storing and rotating secrets, violating the no-credentials requirement. C is wrong because 'Search Service Owner' is an overprivileged administrative role, violating least privilege. D is wrong because Workload Identity Federation is used for non-Azure workloads (like GitHub Actions) to trust external identity providers, not for Azure VM workloads.