Question

Your organization runs multiple Azure AI Foundry projects under a single hub. A compliance requirement states that all projects must authenticate to a centralized Azure Storage account and Azure Key Vault using a single, consistent identity whose credentials the security team can audit and rotate independently of any project's lifecycle. You are authoring the Bicep deployment for the hub and its projects. Which identity configuration should you apply to meet this requirement?

Accepted Answer

Assign a user-assigned managed identity to the hub and reference the same identity in each project deployment, then grant that identity RBAC roles on the storage account and Key Vault.

Answer

Enable a system-assigned managed identity on each project and grant each project's identity RBAC roles on the storage account and Key Vault.

Answer

Create a service principal with a client secret, store the secret in each project's configuration, and use it to authenticate to the shared resources.

Answer

Enable a system-assigned managed identity on the hub only and rely on identity inheritance so projects automatically reuse the hub's system-assigned identity.