Managed identity should be used in web apps

Paritosh Mishra 0

We have a situation with a PAAS application where in Azure Advisor it is asking us to enable Managed identity should be used in web apps and Function APP . Our concern is that if I specifically change this to be Managed indentiese then will it break something? The company is not willing to help us unless we pay for it even though this is a simple question for them to answer that either something will break or nothing will break. But, they want to charge us to provide that answer.

There is no info on their website about .Currently web app used Connection string for conncting DB and using encryted Credential So we dont wnat ot change Code . So, how can we address this. If we enable it and it breaks then we will have to open a case with them and wait for them to get back.

So, any suggestions?

Grmacjon-MSFT 17,136 Reputation points

2024-05-23T21:18:59.86+00:00

@Paritosh Mishra Thanks for bringing this our attention. We are looking into this and will get back to you shortly

Best,

Grace
Paritosh Mishra 0 Reputation points

2024-05-27T06:01:58.14+00:00

Needs an urgent reply pls
Paritosh Mishra 0 Reputation points

2024-06-03T09:49:20.3466667+00:00

Can I expect any answer
Paritosh Mishra 0 Reputation points

2024-06-11T11:24:49.1633333+00:00

No answer yet
Ben Gimblett 3,750 Reputation points Microsoft Employee

2024-06-14T14:30:02.5333333+00:00

Hi - Thanks for the question

So If I understand correct you have a Web App hosted on App Service which depends on a Database and currently the way it's setup is that you use a connection string between App code and database with a credential which is stored encrypted

Now you see an advisor recommendation that managed identities are more preferable than connection strings - which is correct of course, because the [certificate] credential for a managed identity (be that system or user defined) is handled by the Az platform, so using an managed identity means you dont need to manage a credential in code etc.

The first thing you'll need to do though is assess if the database supports entra authentication and if so does it support using a managed identity and if it does how would you configure the identity and roles in the database. You dont mention the database in your question.

The second thing you'll probably not be able to avoid is a change to the code. Because, most of the time database connections are managed via an object (of the database SDK) in code - often with specifics derived from configuration. This is most likely the case for you, but something to check

.

Share via

Managed identity should be used in web apps