Question

Your company runs a fleet of 12 Azure virtual machines that all need to authenticate to the same Azure Key Vault to retrieve secrets. Application developers deploy new VMs to the fleet weekly and decommission old ones just as often. The security team requires that the identity used for Key Vault access remain stable so that the Key Vault access policy does not need to be reconfigured every time the fleet changes. Which identity approach should you implement to meet these requirements with the least ongoing administrative effort?

Accepted Answer

Create a single user-assigned managed identity, assign it to all VMs in the fleet, and grant that identity access to the Key Vault.

Answer

Create a system-assigned managed identity on each VM and grant each one access to the Key Vault individually.

Answer

Register an application in Microsoft Entra ID, generate a client secret, and store the secret on each VM for Key Vault authentication.

Answer

Create a service principal with a certificate credential and distribute the certificate to every VM as it is deployed.