AZ-204 Flashcards
What is deployment slots in Azure App Service?
Deployment slots are live apps with their own host names.
Why would one use deployment slots?
When you need 0 downtime and test your application in a deployed stage
What is the limitations of azure app services when it comes to storage?
When deployed to built-in images, your code and content are allocated a storage volume for web content, backed by Azure Storage. The disk latency of this volume is higher and more variable than the latency of the container filesystem. Apps that require heavy read-only access to content files may benefit from the custom container option, which places files in the container filesystem instead of on the content volume.
What does an Azure App Service Plan include?
- Operating System
- Region
- Number of VM instances
- Size of VM instances
- Pricing Tier
What are the categories of the Azure App Service Plan and what plans do they include?
- Shared compute (Free, Shared)
- Dedicated compute (Basic, Standard, Premium, PremiumV2, PremiumV3)
- Isolated (Isolated, IsolatedV2)
How does authentication and authorization work in Azure App Service?
When enables it acts as a middleware intercepting all http requests to your app. It does the following:
- Authenticates users and clients with the specified identity provider(s)
- Validates, stores, and refreshes OAuth tokens issued by the configured identity provider(s)
- Manages the authenticated session
- Injects identity information into HTTP request headers
What is the two different ways one can do authentication in Azure App Service?
- With provider SDK
- Without provider SDK
What is the different between authentication with and without provider SDK in Azure App Services
Without SDK:
- The application delegates federated sign-in to App Service. This is typically the case with browser apps, which can present the provider’s login page to the user. The server code manages the sign-in process, so it’s also called server-directed flow or server flow.
With SDK:
-The application signs users in to the provider manually and then submits the authentication token to App Service for validation. This is typically the case with browser-less apps, which can’t present the provider’s sign-in page to the user. The application code manages the sign-in process, so it’s also called client-directed flow or client flow. This applies to REST APIs, Azure Functions, JavaScript browser clients, and native mobile apps that sign users in using the provider’s SDK.
What is the inbound network features in Azure App Service
- App assigned address
- Access restriction
- Service endpoints
- Private endpoints
What is the outbound features in Azure App Service
- Hybrid Connections
- Gateway required virtual network integration
- Virtual network integration
Which of the App Service plan categories provides the maximum scale-out capabilities?
Isolated
What are the options of certificates in Azure App Service?
- Create a free App Service managed certificate
- Purchase an App Service certificate
- Import a certificate from Key Vault
- Upload a private certificate
- Upload a public certificate
What is autoscaling?
Autoscaling is a cloud system or process that adjusts available resources based on the current demand. Autoscaling performs scaling in and out, as opposed to scaling up and down.
When should we consider using autoscaling?
When you need higher elasticity, availability and fault tolerance. Autoscaling has an overhead associated with monitoring resources and determining whether to trigger a scaling event. In this scenario, if you can anticipate the rate of growth, manually scaling the system over time may be a more cost effective approach.
What is some of the autoscaling conditions?
- Scale based on a metric (HTTP, disk queue, etc)
- Scale to a specific instance count according to a schedule
What is autoscaling rules?
An autoscale rule specifies a metric to monitor, and how autoscaling should respond when this metric crosses a defined threshold
What autoscaling rules metric can we monitor?
- CPU Percentage
- Memory Percentage
- Disk Queue length
- Http Queue length
- Data in
- Data out
What is Azure Functions?
Azure Functions is a serverless solution that allows you to write less code, maintain less infrastructure, and save on costs.
What is Azure Logic Apps?
Azure Logic Apps is a serverless workflow integration platform
What is the difference between Azure Web jobs and Azure Functions?
Azure Functions is built on the WebJobs SDK, so it shares many of the same event triggers and connections to other Azure services. But some main differences is that you do not pay per use as with Azure functions. It is also not a serverless app model with automatic scaling.
What are the different hosting plans for Azure Functions and what are the differences?
Consumption Plan:
- Default hosting plan
- Scales automatically and you only pay for compute resources when your functions are running
- Event driven. Scale out automatically, even during periods of high load
Premium Plan:
- Automatically scales based on demand using pre-warmed workers, which run applications with no delay after being idle
- Runs on more powerful instances
- Connects to virtual networks.
- Event driven. Scale out automatically, even during periods of high load
Dedicated Plan:
- Run your functions within an App Service plan at regular App Service plan rates. Best for long-running scenarios where Durable Functions can’t be used.
- Manual/auto scale
Which two componewnts is needed to create an Azure Function (Development)?
A function contains two important pieces - your code, which can be written in various languages, and some config, the function.json file.
What determines wether an Azure Function is to scale-out / scale-in?
Azure Functions uses a component called the scale controller to monitor the rate of events and determine whether to scale out or scale in. The scale controller uses heuristics for each trigger type.
What does the bindings property in the Azure Functions config file do?
The bindings property is where you configure both triggers and bindings.
What is a function app in Azure?
A function app provides an execution context in Azure in which your functions run. As such, it’s the unit of deployment and management for your functions. A function app is composed of one or more individual functions that are managed, deployed, and scaled together. All of the functions in a function app share the same pricing plan, deployment method, and runtime version. Think of a function app as a way to organize and collectively manage your functions.
What is Azure Blob Storage?
Azure Blob storage is Microsoft’s object storage solution for the cloud
What is Azure Blob Storage designed for?
- Serving images or documents directly to a browser.
- Storing files for distributed access.
- Streaming video and audio.
- Writing to log files.
- Storing data for backup and restore, disaster recovery, and archiving.
- Storing data for analysis by an on-premises or Azure-hosted service.
What is the different access tiers for block blob data?
Hot:
- Is optimized for frequent access of objects in the storage account. The Hot tier has the highest storage costs, but the lowest access costs. New storage accounts are created in the hot tier by default.
Cool:
Is optimized for storing large amounts of data that is infrequently accessed and stored for at least 30 days. The Cool tier has lower storage costs and higher access costs compared to the Hot tier.
Archive:
- Is available only for individual block blobs. The archive tier is optimized for data that can tolerate several hours of retrieval latency and will remain in the Archive tier for at least 180 days. The archive tier is the most cost-effective option for storing data, but accessing that data is more expensive than accessing data in the hot or cool tiers.
What are the types of storage accounts and what are their usage
General-purpose v2
- Standard storage account type for blobs, file shares, queues, and tables. Recommended for most scenarios using Blob Storage or one of the other Azure Storage services.
Block Blob
- Premium storage account type for block blobs and append blobs. Recommended for scenarios with high transaction rates or that use smaller objects or require consistently low storage latency
Page blobs
- Premium storage account type for page blobs only.
What is the hierarchy Azure Blob Storage
Storage Acoount - Container - Blob
What is a storage account?
A storage account provides a unique namespace in Azure for your data. Every object that you store in Azure Storage has an address that includes your unique account name. The combination of the account name and the Azure Storage blob endpoint forms the base address for the objects in your storage account.
What is a container in Azure Blob Storage
A container organizes a set of blobs, similar to a directory in a file system. A storage account can include an unlimited number of containers, and a container can store an unlimited number of blobs.
Which three types does Azure Storage support and what are their use?
Azure Storage supports three types of blobs:
- Block blobs store text and binary data. Block blobs are made up of blocks of data that can be managed individually. Block blobs can store up to about 190.7 TiB.
- Append blobs are made up of blocks like block blobs, but are optimized for append operations. Append blobs are ideal for scenarios such as logging data from virtual machines.
-Page blobs store random access files up to 8 TB in size. Page blobs store virtual hard drive (VHD) files and serve as disks for Azure virtual machines.
What is a Azure Blob Storage lifecycle management policy?
A lifecycle management policy is a collection of rules in a JSON document to manage the lifecycle of data that is stored in various tiers in Azure Blob Storage
What does Azure Blob Storage lifecycle management policy enable us to do?
- Transition blobs to a cooler storage tier (hot to cool, hot to archive, or cool to archive) to optimize for performance and cost
- Delete blobs at the end of their lifecycles
- Define rules to be run once per day at the storage account level
- Apply rules to containers or a subset of blobs (using prefixes as filters)
What are rules in Azure Blob Storageand what two things is in a rule?
Rules help mange your data in Azure Blob Storage. One example is lifecycle management policy. Each rule definition includes a filter set and an action set. The filter set limits rule actions to a certain set of objects within a container or objects names. The action set applies the tier or delete actions to the filtered set of objects.
What are rule filters in Azure Blob Storage?
Filters limit rule actions to a subset of blobs within the storage account. If more than one filter is defined, a logical AND runs on all filters. Filters include:
- blobTypes: An array of predefined enum values.
- prefixMatch: An array of strings for prefixes to be match. Each rule can define up to 10 prefixes. A prefix string must start with a container name.
- blobIndexMatch: An array of dictionary values consisting of blob index tag key and value conditions to be matched. Each rule can define up to 10 blob index tag condition.
What are rule actions in Azure Blob Storage?
In Azure Blob Storage, rule actions are part of the Lifecycle Management policy, which allows you to create rules to automatically transition your data to the best access tier and optimize costs. The rule actions define what operations to perform on the blobs when the conditions specified in the rule are met. Actions are applied to the filtered blobs when the run condition is met.
What are some of the rules action defined in the lifecycle management policy
- tierToCool
- enableAutoTierToHotFromCool
- tierToArchive
- delete
What happens if we define more than one rule actions to a blob?
If you define more than one action on the same blob, lifecycle management applies the least expensive action to the blob. For example, action delete is cheaper than action tierToArchive. Action tierToArchive is cheaper than action tierToCool.
What are some of the rules condition defined in the lifecycle management policy
- daysAfterModificationGreaterThan
- daysAfterCreationGreaterThan
- daysAfterLastAccessTimeGreaterThan
- daysAfterLastTierChangeGreaterThan
What are our two options of rehydrating blob data from the archieve tier?
Copy an archived blob to an online tier:
- You can rehydrate an archived blob by copying it to a new blob in the hot or cool tier with the Copy Blob or Copy Blob from URL operation. Microsoft recommends this option for most scenarios.
- Change a blob’s access tier to an online tier
- You can rehydrate an archived blob to hot or cool by changing its tier using the Set Blob Tier operation.
What header can we set to adjust the priority on the rehydration?
x-ms-rehydrate-priority
What are the two priorties when rehydrating a blob and what are the differences?
Standard priority: The rehydration request is processed in the order it was received and might take up to 15 hours.
High priority: The rehydration request is prioritized over standard priority requests and might complete in under one hour for objects under 10 GB in size.
What is one thing to note when rehydrating a blob when it come to lifecycle management policies?
Changing a blob’s tier doesn’t affect its last modified time. If there is a lifecycle management policy in effect for the storage account, then rehydrating a blob with Set Blob Tier can result in a scenario where the lifecycle policy moves the blob back to the archive tier after rehydration because the last modified time is beyond the threshold set for the policy.
In .NET, what does BlobServiceClient class do?
Represents the storage account, and provides operations to retrieve and configure account properties, and to work with blob containers in the storage account.
In .NET, what does BlobContainerClient class do?
Represents a specific blob container, and provides operations to work with the container and the blobs within.
In .NET, what does BlobClient class do?
Represents a specific blob, and provides general operations to work with the blob, including operations to upload, download, delete, and create snapshots.
In .NET, what does AppendBlobClient class do?
Represents an append blob, and provides operations specific to append blobs, such as appending log data.
In .NET, what does BlockBlobClient class do?
Represents a block blob, and provides operations specific to block blobs, such as staging and then committing blocks of data.
What HTTP headers are supported for both containers and blobs when setting properties by using REST
Last-Modified
What is Azure Cosmos DB
Azure Cosmos DB is a fully managed NoSQL database designed to provide low latency, elastic scalability of throughput, well-defined semantics for data consistency, and high availability.
What is the hierarchy in Azure Cosmos DB?
- Database Accounts
- Databases
- Containers
- Db Items
What is an Azure Cosmos Db Storage Containers?
An Azure Cosmos DB container is the unit of scalability both for provisioned throughput and storage. A container is horizontally partitioned and then replicated across multiple regions. The items that you add to the container are automatically grouped into logical partitions, which are distributed across physical partitions, based on the partition key.
What is two different types of throughput mode in Azure Cosmos DB Containers?
- Dedicated provisioned throughput mode: The throughput provisioned on a container is exclusively reserved for that container and it’s backed by the SLAs.
- Shared provisioned throughput mode: These containers share the provisioned throughput with the other containers in the same database (excluding containers that have been configured with dedicated provisioned throughput). In other words, the provisioned throughput on the database is shared among all the “shared throughput” containers.
What are the consistency levels of Azure Cosmos DB
- Strong
- Bounded staleness
- Session
- Consistent prefix
- Eventual
What is strong consistency level of Azure Cosmos DB?
Strong consistency offers a linearizability guarantee. Linearizability refers to serving requests concurrently. The reads are guaranteed to return the most recent committed version of an item. A client never sees an uncommitted or partial write. Users are always guaranteed to read the latest committed write.
What is Bounded staleness consistency level of Azure Cosmos DB?
Cosmos DB allows a certain amount of lag (in terms of time or operations) between the primary data copy and its other copies. Once that boundary is crossed, the system makes sure all copies are up-to-date.
What is Session consistency level of Azure Cosmos DB?
In session consistency, within a single client session reads are guaranteed to honor the consistent-prefix, monotonic reads, monotonic writes, read-your-writes, and write-follows-reads guarantees. This assumes a single “writer” session or sharing the session token for multiple writers.
What is Consistent prefixconsistency level of Azure Cosmos DB?
Consistent prefix provides the assurance that you’ll never read data in a sequence that’s different from the way it was written, making sure there’s a logical flow to the data changes you observe.
What is Eventual consistency level of Azure Cosmos DB?
In eventual consistency, there’s no ordering guarantee for reads. In the absence of any further writes, the replicas eventually converge.
Eventual consistency is the weakest form of consistency because a client may read the values that are older than the ones it read before. Eventual consistency is ideal where the application doesn’t require any ordering guarantees. Examples include count of Retweets, Likes, or nonthreaded comments
What is Azure Cosmos DB API?
These APIs allow your applications to treat Azure Cosmos DB as if it were various other databases technologies, without the overhead of management, and scaling approaches.
When should one use Azure Comos DB API?
- If you have existing MongoDB, PostgreSQL Cassandra, or Gremlin applications
- If you don’t want to rewrite your entire data access layer
- If you want to use the open-source developer ecosystem, client-drivers, expertise, and resources for your database
What is Request Units (RU’s) in regards to Azure Cosmos DB?
The cost of all database operations is normalized by Azure Cosmos DB and is expressed by request units (or RUs, for short). A request unit represents the system resources such as CPU, IOPS, and memory that are required to perform the database operations supported by Azure Cosmos DB.
Which three modes can you Storage Account be in and what is the differences?
Provisioned throughput mode:
- In this mode, you provision the number of RUs for your application on a per-second basis in increments of 100 RUs per second. To scale the provisioned throughput for your application, you can increase or decrease the number of RUs at any time in increments or decrements of 100 RUs. You can make your changes either programmatically or by using the Azure portal. You can provision throughput at container and database granularity level.
Serverless mode:
- In this mode, you don’t have to provision any throughput when creating resources in your Azure Cosmos DB account. At the end of your billing period, you get billed for the number of request units that have been consumed by your database operations.
Autoscale mode:
- In this mode, you can automatically and instantly scale the throughput (RU/s) of your database or container based on its usage. This scaling operation doesn’t affect the availability, latency, throughput, or performance of the workload. This mode is well suited for mission-critical workloads that have variable or unpredictable traffic patterns, and require SLAs on high performance and scale.
In .NET, what is the CosmosClient?
Creates a new CosmosClient with a connection string. CosmosClient is thread-safe. It’s recommended to maintain a single instance of CosmosClient per lifetime of the application that enables efficient connection management and performance.
How can we create a stored procedure in Azure Cosmos DB
It can be written in Javascript as code
What two different triggers does Azure Cosmos DB support? And what is the difference?
Pretriggers:
Executed before modifying a database item.
Posttriggers:
Executed after modifying a database item
What can triggers in Azure Cosmos DB be used for?
- Validation of data
- Adding metadata
What is the change feed in Azure Cosmos DB?
Change feed in Azure Cosmos DB is a persistent record of changes to a container in the order they occur. Change feed support in Azure Cosmos DB works by listening to an Azure Cosmos DB container for any changes. It then outputs the sorted list of documents that were changed in the order in which they were modified. The persisted changes can be processed asynchronously and incrementally, and the output can be distributed across one or more consumers for parallel processing.
Which two methods can you work with Azure Cosmos DB change feed?
- Push Model
- Pull Model
How does the push model work for working with change feed in Azure Cosmos DB?
With a push model, the change feed processor pushes work to a client that has business logic for processing this work. However, the complexity in checking for work and storing state for the last processed work is handled within the change feed processor. This is the recommended model because you won’t need to worry about polling the change feed for future changes, storing state for the last processed change, and other benefits.
How does the pull model work for working with change feed in Azure Cosmos DB?
With a pull model, the client has to pull the work from the server. The client, in this case, not only has business logic for processing work but also storing state for the last processed work, handling load balancing across multiple clients processing work in parallel, and handling errors.
Which two methods can you read from the change feed with a push model?
- Azure Functions
- Change feed processor
What is the Change feed processor in regards to Azure Cosmos DB?
The change feed processor is part of the Azure Cosmos DB .NET V3 and Java V4 SDKs. It simplifies the process of reading the change feed and distributes the event processing across multiple consumers effectively.
What are the four main components in implementing the Change feed processor in Azure Cosmos Db?
- The monitored container: The monitored container has the data from which the change feed is generated. Any inserts and updates to the monitored container are reflected in the change feed of the container.
- The lease container: The lease container acts as a state storage and coordinates processing the change feed across multiple workers. The lease container can be stored in the same account as the monitored container or in a separate account.
- The compute instance: A compute instance hosts the change feed processor to listen for changes. Depending on the platform, it could be represented by a VM, a kubernetes pod, an Azure App Service instance, an actual physical machine. It has a unique identifier referenced as the instance name throughout this article.
- The delegate: The delegate is the code that defines what you, the developer, want to do with each batch of changes that the change feed processor reads.
What is Azure Container Registry (ACR)?
Azure Container Registry (ACR) is a managed, private Docker registry service based on the open-source Docker Registry 2.0. Create and maintain Azure container registries to store and manage your private Docker container images.
What are some of the use cases of ACR?
- Scalable orchestration systems that manage containerized applications across clusters of hosts, including Kubernetes, DC/OS, and Docker Swarm.
- Azure services that support building and running applications at scale, including Azure Kubernetes Service (AKS), App Service, Batch, Service Fabric, and others.
What are the service tiers of ACR, and what are the differences?
Basic:
- A cost-optimized entry point for developers learning about Azure Container Registry. Basic registries have the same programmatic capabilities as Standard and Premium (such as Microsoft Entra authentication integration, image deletion, and webhooks). However, the included storage and image throughput are most appropriate for lower usage scenarios.
Standard:
- Standard registries offer the same capabilities as Basic, with increased included storage and image throughput. Standard registries should satisfy the needs of most production scenarios.
Premium:
- Premium registries provide the highest amount of included storage and concurrent operations, enabling high-volume scenarios. In addition to higher image throughput, Premium adds features such as geo-replication for managing a single registry across multiple regions, content trust for image tag signing, and private link with private endpoints to restrict access to the registry.
What is the storage capabilities/features in Azure Container Registry?
- Encyrption at rest
- Regional storage
- Zone redundancy
- Scalable storage
What is Azure Container Instances
Azure Container Instances (ACI) is a great solution for any scenario that can operate in isolated containers, including simple applications, task automation, and build jobs.
What are the benefits of using ACI?
- Fast startup: ACI can start containers in Azure in seconds, without the need to provision and manage VMs
- Container access: ACI enables exposing your container groups directly to the internet with an IP address and a fully qualified domain name (FQDN)
- Hypervisor-level security: Isolate your application as completely as it would be in a VM
- Customer data: The ACI service stores the minimum customer data required to ensure your container groups are running as expected
- Custom sizes: ACI provides optimum utilization by allowing exact specifications of CPU cores and memory
- Persistent storage: Mount Azure Files shares directly to a container to retrieve and persist state
- Linux and Windows: Schedule both Windows and Linux containers using the same API.
What is a container group in ACI?
The top-level resource in Azure Container Instances is the container group. A container group is a collection of containers that get scheduled on the same host machine. The containers in a container group share a lifecycle, resources, local network, and storage volumes. It’s similar in concept to a pod in Kubernetes.
What are the two ways to deploy a multi container group?
There are two common ways to deploy a multi-container group: use a Resource Manager template or a YAML file. A Resource Manager template is recommended when you need to deploy additional Azure service resources (for example, an Azure Files share) when you deploy the container instances. Due to the YAML format’s more concise nature, a YAML file is recommended when your deployment includes only container instances.
When should one use Yaml file vs Resource Manager template?
One should use Yaml file if it only contains container instances, but it other azure services need to be orchestrated the Resource Manager template is desired
What is the restart policies of ACI? And what does it do?
Always:
- Containers in the container group are always restarted. This is the default setting applied when no restart policy is specified at container creation.
Never:
- Containers in the container group are never restarted. The containers run at most once.
OnFailure:
- Containers in the container group are restarted only when the process executed in the container fails (when it terminates with a nonzero exit code). The containers are run at least once.
What is Azure Container Apps?
Azure Container Apps provides the flexibility you need with a serverless container service built for microservice applications and robust autoscaling capabilities without the overhead of managing complex infrastructure.
What are some if the limitations of Azure Container Apps`?
Privileged containers: Azure Container Apps can’t run privileged containers. If your program attempts to run a process that requires root access, the application inside the container experiences a runtime error.
Operating system: Linux-based (linux/amd64) container images are required.
What is a revition in Azure Container App?
A revision is an immutable snapshot of a container app version.
How does Azure Container APp manages secrets?
By using Revistion, an immutable snapshot of a container app version.
What four components make up Azure Identity Platform?
- OAuth 2.0 and OpenID Connect standard-compliant authentication service enabling developers to authenticate several identity types
- Open-source libraries: Microsoft Authentication Libraries (MSAL) and support for other standards-compliant libraries
- Application management portal: A registration and configuration experience in the Azure portal, along with the other Azure management capabilities.
- Application configuration API and PowerShell: Programmatic configuration of your applications through the Microsoft Graph API and PowerShell so you can automate your DevOps tasks.
What is service principle in regards to Azure Identity Platform?
An Azure service principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources
What is the difference between single and multi-tenant applications?
Single tenant: only accessible in your tenant
Multi-tenant: accessible in other tenants
What is an application object in regards to Azure Identity Platform?
The application object resides in the Microsoft Entra tenant where the application was registered (known as the application’s “home” tenant). An application object is used as a template or blueprint to create one or more service principal objects. It consist of some static properties that describes three aspects of an application: how the service can issue tokens in order to access the application, resources that the application might need to access, and the actions that the application can take.
What three different types of service principals do we have?
- Application
- Managed Identity
- Legacy
What is typeApplication of service principle in regards to Azure Identity?
This type of service principal is the local representation, or application instance, of a global application object in a single tenant or directory. A service principal is created in each tenant where the application is used and references the globally unique app object. The service principal object defines what the app can actually do in the specific tenant, who can access the app, and what resources the app can access.
What is type Managed Identity of service principle in regards to Azure Identity?
This type of service principal is used to represent a managed identity. Managed identities provide an identity for applications to use when connecting to resources that support Microsoft Entra authentication. When a managed identity is enabled, a service principal representing that managed identity is created in your tenant. Service principals representing managed identities can be granted access and permissions, but can’t be updated or modified directly.
What is type Legacy of service principle in regards to Azure Identity?
This type of service principal represents a legacy app, which is an app created before app registrations were introduced or an app created through legacy experiences. A legacy service principal can have credentials, service principal names, reply URLs, and other properties that an authorized user can edit, but doesn’t have an associated app registration. The service principal can only be used in the tenant where it was created.
What is the relationship between application object and service principle in regards to Azure Identity?
The application object is the global representation of your application for use across all tenants, and the service principal is the local representation for use in a specific tenant. The application object serves as the template from which common and default properties are derived for use in creating corresponding service principal objects.
What is scope in oauth2
It is another word for permistions. It contains the permissions for the user.
What two permission types do we have in Microsoft Identity Platform?
Delegated permissions
App-only access permissions
What is Delegated permissions in Microsoft Identity Platform?
Delegated permissions are used by apps that have a signed-in user present. For these apps, either the user or an administrator consents to the permissions that the app requests. The app is delegated with the permission to act as a signed-in user when it makes calls to the target resource.
What is App-only access permissions in Microsoft Identity Platform?
App-only access permissions are used by apps that run without a signed-in user present, for example, apps that run as background services or daemons. Only an administrator can consent to app-only access permissions.
What three consent types do we have in regards to Microsoft Identity Platform?
- static user consent
- incremental and dynamic user consent
- admin consent.
What is static user consent in regards to Microsoft Identity Platform
In the static user consent scenario, you must specify all the permissions it needs in the app’s configuration in the Azure portal. If the user (or administrator, as appropriate) hasn’t granted consent for this app, then Microsoft identity platform prompts the user to provide consent at this time. Static permissions also enable administrators to consent on behalf of all users in the organization.
What is some negatives of using static user consent in regards to Microsoft Identity Platform?
- The app needs to request all the permissions it would ever need upon the user’s first sign-in. This can lead to a long list of permissions that discourages end users from approving the app’s access on initial sign-in.
- The app needs to know all of the resources it would ever access ahead of time. It’s difficult to create apps that could access an arbitrary number of resources.
What is incremental and dynamic consent in regards to Microsoft Identity Platform?
Incremental and dynamic consent in the context of Azure Identity refers to the practice of asking users for permission step-by-step, only at the time when a particular access level is needed, instead of asking for all permissions upfront.
What are some things to note when using incremental and dynamic consent?
Dynamic consent can be convenient, but presents a big challenge for permissions that require admin consent, since the admin consent experience doesn’t know about those permissions at consent time. If you require admin privileged permissions or if your app uses dynamic consent, you must register all of the permissions in the Azure portal (not just the subset of permissions that require admin consent). This enables tenant admins to consent on behalf of all their users.
What is admin consent in regards to Microsoft Identity Platform?
Admin consent in Azure Identity refers to a scenario where an administrator grants permissions on behalf of all users within an organization. Instead of each individual user granting consent for an application to access their data, an administrator can provide consent once, allowing the application to work for all users without them having to go through the consent process individually. This is particularly useful for enterprise
What is conditional access in regards to Microsoft Identity Platform?
The Conditional Access feature in Microsoft Entra ID offers one of several ways that you can use to secure your app and protect a service. Conditional Access enables developers and enterprise customers to protect services in a multitude of ways including:
- Multifactor authentication
- Allowing only Intune enrolled devices to access specific services
- Restricting user locations and IP ranges
In general, conditional access to not require code changes, but when is it required?
Specifically, the following scenarios require code to handle Conditional Access challenges:
- Apps performing the on-behalf-of flow
- Apps accessing multiple services/resources
- Single-page apps using MSAL.js
- Web apps calling a resource
What is Microsoft Authentication Library (MSAL)?
The Microsoft Authentication Library (MSAL) can be used to provide secure access to Microsoft Graph, other Microsoft APIs, third-party web APIs, or your own web API.
MSAL gives you many ways to get tokens, with a consistent API for many platforms.
What is the benefits os using MSAL?
- No need to directly use the OAuth libraries or code against the protocol in your application.
- Acquires tokens on behalf of a user or on behalf of an application (when applicable to the platform).
- Maintains a token cache and refreshes tokens for you when they’re close to expire. - - You don’t need to handle token expiration on your own.
- Helps you specify which audience you want your application to sign in.
- Helps you set up your application from configuration files.
- Helps you troubleshoot your app by exposing actionable exceptions, logging, and telemetry.
What is the supported authentication flows of MSAL?
- Authorization code: Native and web apps securely obtain tokens in the name of the user
- Client credentials: Service applications run without user interaction
- On-behalf-of: The application calls a service/web API, which in turns calls Microsoft Graph
- Implicit: Used in browser-based applications
- Device code: Enables sign-in to a device by using another device that has a browser
- Integrated Windows: Windows computers silently acquire an access token when they’re domain joined
- Interactive: Mobile and desktops applications call Microsoft Graph in the name of a user
- Username/password: The application signs in a user by using their username and password
Which two .NET classes is used to setup MSAL?
With MSAL.NET 3.x, the recommended way to instantiate an application is by using the application builders: PublicClientApplicationBuilder and ConfidentialClientApplicationBuilder. They offer a powerful mechanism to configure the application either from the code, or from a configuration file, or even by mixing both approaches.
What is shared access signatures (SAS)?
A shared access signature (SAS) is a signed URI that points to one or more storage resources and includes a token that contains a special set of query parameters. The token indicates how the resources may be accessed by the client.
What types of shared access signatures (SAS) do we have?
- User delegation SAS
- Service SAS
- Account SAS
What is User delegation SAS?
A user delegation SAS is secured with Microsoft Entra credentials and also by the permissions specified for the SAS. A user delegation SAS applies to Blob storage only.
What does user delegation sas apply to?
Only blob storage
What is service SAS?
The Service SAS can be restricted to a specific service, such as Azure Blob Storage, Azure Table Storage, Azure Queue Storage, or Azure File Storage. The permissions granted by a Service SAS are scoped to a specific resource, such as a blob, container, table, queue, or file.
What does service SAS apply to?
Blob storage, Queue storage, Table storage, or Azure Files.
What is Account SAS?
An account SAS is secured with the storage account key. An account SAS delegates access to resources in one or more of the storage services. All of the operations available via a service or user delegation SAS are also available via an account SAS.
How does Shared Access signatures work?
When you use a SAS to access data stored in Azure Storage, you need two components. The first is a URI to the resource you want to access. The second part is a SAS token that you’ve created to authorize access to that resource.
How to reduce the potential risks of using SAS?
- To securely distribute a SAS and prevent man-in-the-middle attacks, always use HTTPS.
- The most secure SAS is a user delegation SAS. Use it wherever possible because it removes the need to store your storage account key in code. You must use Microsoft - - Entra ID to manage credentials. This option might not be possible for your solution.
- Try to set your expiration time to the smallest useful value. If a SAS key becomes compromised, it can be exploited for only a short time.
- Apply the rule of minimum-required privileges. Only grant the access that’s required. - For example, in your app, read-only access is sufficient.
- There are some situations where a SAS isn’t the correct solution. When there’s an unacceptable risk of using a SAS, create a middle-tier service to manage users and their access to storage.
When should one use SAS?
Use a SAS when you want to provide secure access to resources in your storage account to any client who doesn’t otherwise have permissions to those resources.
What is stored access policy in regards to SAS?
A stored access policy provides an extra level of control over service-level shared access signatures (SAS) on the server side. Establishing a stored access policy groups SAS and provides more restrictions for signatures that are bound by the policy. You can use a stored access policy to change the start time, expiry time, or permissions for a signature, or to revoke it after it has been issued.
What supports stored access policies?
- Blob containers
- File shares
- Queues
- Tables
What is Microsoft Graph?
Microsoft Graph is the gateway to data and intelligence in Microsoft 365. It provides a unified programmability model that you can use to access the tremendous amount of data in Microsoft 365, Windows 10, and Enterprise Mobility + Security.
What is the three main components in Microsoft Graph that facilitate the access and flow of data?
- The Microsoft Graph API offers a single endpoint.
- Microsoft Graph connectors
- Microsoft Graph Data Connect
What are the two ways we can interact with Microsoft Graph?
- REST API
- .NET SDK
When querying Microsoft Graph using REST API what methods does it support and what does each method do?
GET: Read data from a resource.
POST: Create a new resource, or perform an action.
PATCH: Update a resource with new values.
PUT: Replace a resource with a new one.
DELETE: Remove a resource.
How is a REST query structured in Microsoft Graph?
{HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters}
{HTTP method} - The HTTP method used on the request to Microsoft Graph.
{version} - The version of the Microsoft Graph API your application is using.
{resource} - The resource in Microsoft Graph that you’re referencing.
{query-parameters} - Optional OData query options or REST method parameters that customize the response.
When using Microsoft Graph with the .NET SDK, what class do we make to create the client?
GraphServiceClient
What is best practices when using Microsoft Graph?
- Authentication
- Consent and Authorization
- Handle responses effectively, pagination etc
- Storing Data Locally: Your application should ideally make calls to Microsoft Graph to retrieve data in real time as necessary. You should only cache or store data locally necessary for a specific scenario, and if that use case is covered by your terms of use and privacy policy, and doesn’t violate the Microsoft APIs Terms of Use. Your application should also implement proper retention and deletion policies.
What is Microsoft Graph Connectors?
Microsoft Graph connectors work in the incoming direction, delivering data external to the Microsoft cloud into Microsoft Graph services and applications, to enhance Microsoft 365 experiences such as Microsoft Search. Connectors exist for many commonly used data sources such as Box, Google Drive, Jira, and Salesforce.
What is Microsoft Graph Data connect?
Microsoft Graph Data Connect provides a set of tools to streamline secure and scalable delivery of Microsoft Graph data to popular Azure data stores. The cached data serves as data sources for Azure development tools that you can use to build intelligent applications.
What two types of containers do Azure Key Vault support and what are their differences?
- Vaults: support storing software, HSM-backed keys, secrets, and certificates
- hardware security module(HSM) pools: HSM-backed keys
What are the benefits of using Azure Key Vault?
- Centralized application secrets
- Securely store secrets and keys
- Monitor access and use
- Simplified administration of application secrets
What are best practices when it comes to Azure Key Vault?
- Use separate key vaults
- Control access to your vault
- Backup
- Logging
- Recovery Options
Which two different ways can one obtain a service principle to Azure Key vault?
- Enable a system-assigned managed identity for the application. With managed identity, Azure internally manages the application’s service principal and automatically authenticates the application with other Azure services. Managed identity is available for applications deployed to various services.
- If you can’t use managed identity, you instead register the application with your Microsoft Entra tenant. Registration also creates a second application object that identifies the app across all tenants.
What is managed identities?
A common challenge for developers is the management of secrets, credentials, certificates, and keys used to secure communication between services. Managed identities eliminate the need for developers to manage these credentials. Managed identities provide an automatically managed identity in Microsoft Entra ID for applications to use when connecting to resources that support Microsoft Entra authentication. Applications can use managed identities to obtain Microsoft Entra tokens without having to manage any credentials.
What are the two types of managed identities?
System-assigned managed identity
User-assigned managed identity
What is System-assigned managed identity?
A system-assigned managed identity is enabled directly on an Azure service instance. When the identity is enabled, Azure creates an identity for the instance in the Microsoft Entra tenant that’s trusted by the subscription of the instance. After the identity is created, the credentials are provisioned onto the instance. The lifecycle of a system-assigned identity is directly tied to the Azure service instance that it’s enabled on. If the instance is deleted, Azure automatically cleans up the credentials and the identity in Microsoft Entra ID.
What is User-assigned managed identity?
A user-assigned managed identity is created as a standalone Azure resource. Through a create process, Azure creates an identity in the Microsoft Entra tenant that’s trusted by the subscription in use. After the identity is created, the identity can be assigned to one or more Azure service instances. The lifecycle of a user-assigned identity is managed separately from the lifecycle of the Azure service instances to which it’s assigned.
What azure resources support managed identites?
Azure resources that supports Microsoft Entra authentication
What is the flag to enable system-assigned managed identity during creation of an Azure virtual machine?
–assign-identity, followed by –role, –scope, –admin-username and –admin-password
