SC-100 Certification Practice Question #18

Question

For an Azure deployment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark.

You need to recommend a best practice for implementing service accounts for Azure API management.

What should you include in the recommendation?

Accepted Answer

The Microsoft Cloud Security Benchmark control IM-3 ("Manage application identities securely and automatically") directs you to use managed identities so that credentials are fully managed, rotated, and protected by the platform — avoiding hard-coded secrets. The API Management security baseline specifically states to use a Managed Service Identity to let the APIM instance access Azure AD-protected resources "instead of using service principals." The Suggested Answer, the 52-vote community consensus, and the two highest-voted "B" comments (Rocko1 13 👍, smosmo 11 👍) all align with this. The mynk29 dissent (A, 15 👍) is a reasonable reading of the OAuth-protection guidance but concerns authenticating API developers/consumers, not implementing service accounts; for the "service account" requirement the most secure, MCSB-recommended option is a managed identity. Service-principal options (C/E) are explicitly the fallback "where managed identities are not applicable" (IM-3.2), so B wins.

More SC-100 practice questions