You develop and deploy an Azure App Service web app named App1. You create a new Azure Key Vault named Vault 1. You import several API keys, passwords, certificates, and cryptographic keys into Vault1. You need to grant App1 access to Vault1 and automatically rotate credentials Credentials must not be stored in code. What should you do?

Assigning a managed identity to the App Service (App1) creates an identity for it in Azure Active Directory (Azure AD). This identity can then be granted access to the Key Vault (Vault1) via an access policy. The Azure platform automatically manages the credentials (the service principal) for this identity, including rotation. The application code can then use this identity to request an access token from Azure AD to authenticate to Key Vault without needing any secrets or keys stored in the application's code or configuration, fulfilling all requirements of the scenario.

A. Enable App Service authentication for Appt. Assign a custom RBAC role to Vault1. App Service Authentication (Easy Auth) is for authenticating end-users accessing the web app, not for the app's own identity to access other Azure resources.
B. Add a TLS/SSL binding to App1. TLS/SSL bindings are used to secure inbound HTTP traffic to the web app from clients. They are not used for authenticating the app to other backend services.
D. Upload a self-signed client certificate to Vault1. Update App1 to use the client certificate. This method requires manual creation, management, and rotation of the certificate, which contradicts the requirement to "automatically rotate credentials." Managed identities handle this automatically.

1. Microsoft Docs, "What are managed identities for Azure resources?": "Managed identities for Azure resources is a feature of Azure Active Directory. It provides Azure services with an automatically managed identity in Azure AD. You can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code."

Section: Introduction, "What are managed identities for Azure resources?" paragraph 1.

2. Microsoft Docs, "Tutorial: Use a managed identity to connect Key Vault to an Azure web app": This tutorial explicitly details the process. "This tutorial shows you how to use a managed identity to access Azure Key Vault from an Azure App Service web app... You don't have to store any secrets in your code or configuration."

Section: "Overview" and "Create a managed identity".

3. Microsoft Docs, "Key Vault authentication options": This document compares authentication methods. "For applications deployed on Azure, we recommend using a managed identity... The credentials used by a managed identity are fully managed by the platform and are automatically rotated."

Section: "Managed identity".