According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn documentation on Managed Identities for Azure Resources, the recommended and most secure method for an Azure resource (like an App Service) to access another Azure resource (such as an Azure SQL Database) is through Managed Identities.
Managed identities allow Azure services to authenticate securely to other Azure services that support Azure AD authentication, without requiring the use of credentials stored in code, configuration files, or key vaults.
There are two types of managed identities:
* System-assigned managed identity
* Created and tied directly to the lifecycle of a specific Azure resource (e.g., App Service).
* When the resource (App1) is deleted, the identity is automatically deleted as well.
* Best suited when a single resource requires authentication to access another Azure service.
* User-assigned managed identity
* Created as an independent Azure resource.
* Can be assigned to multiple services and managed separately.
* Useful for scenarios requiring shared identity or cross-service authentication management.
* App1 (Azure App Service) must access db1 (Azure SQL Database).
* Credentials should be available only to App1, meaning other resources should not share or reuse the identity.
* Administrative effort should be minimized, implying automatic management of credentials and lifecycle.
Hence, a system-assigned managed identity is the best solution because it meets all three conditions:
* No manual credential management (Azure handles authentication token issuance automatically).
* The identity exists only for App1 (it's unique to that resource).
* Simplified lifecycle - identity is created and deleted automatically with App1.
# Official Microsoft Documentation (aligned with SC-300 exam objectives):
"System-assigned managed identities are ideal for scenarios where a single Azure resource requires access to another Azure service and you want Azure to automatically manage the identity's lifecycle."
"Managed identities eliminate the need for developers to manage credentials in code or configuration files."