Chapter 6
The example scenario can be broken down into three main requirements:
- Protection of connection strings
To protect connection strings, we can use a key vault to store the connection strings as secrets. We can then use a user-assigned managed identity on any web or API app that needs the connection string, along with an access policy that allows that identity to read the secret. The apps themselves will need to be written with this in mind by using the appropriate NuGet packages.
- Customer-provided keys for storage encryption
Generate and store a key in a key vault. Configure the storage account to use that key as a customer-managed key instead of the Microsoft-managed key.
- An authentication mechanism that supports N-tier and distributed systems
Create an app registration for your app and enable ID tokens. On each of the apps, configure them to use Microsoft Active Directory in the authentication/authorization blade and choose the app registration you created. Set the...
