Plan and implement identities for applications and Azure workloads
Objective identities.apps-azure-workloads sits in Plan and implement workload identities, which carries 22% of the Identity and Access Admin exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.
Objective title verbatim from the official objectives. Microsoft Azure exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A developer builds an automated app that must create resources in one resource group without ever signing in as a user. Which security principal type should receive the Azure RBAC role assignment for the app?
The concept
Azure RBAC role assignments target a security principal, which can be a user, group, service principal, or managed identity, so applications and workloads get their own identity type rather than borrowing a user's credentials.
Why this answer
The app's registered identity in Microsoft Entra ID is represented as a service principal, which is one of the four security principal types that can receive a role assignment for an Azure resource.
- Correct: a service principal is the security principal type that represents an application's identity for role assignment purposes.
- BA dedicated user account would work technically but does not follow the workload identity model and mixes human and application access.
- CA security group represents people who manage the app, not the app's own identity, so it does not fit the role assignment target here.
- DA role definition lists permitted actions but is not a security principal, so it cannot itself be assigned a role.
- EA management group is a scope level for where access applies, not a security principal that requests access.
Now you: objective identities.apps-azure-workloads questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A service principal for an automated workload is assigned the Contributor role at the subscription scope and the Reader role directly on one resource group within that subscription. What are its effective permissions on that resource group?
Sample question 2 of 3
A developer registers an application in Microsoft Entra ID. The app must run unattended and manage all resources in a resource group without any interactive sign-in. Which security principal type is created to represent this application's identity for the role assignment?
Sample question 3 of 3
Why must an application be registered with a Microsoft Entra tenant before it can use the platform?
Full Identity and Access Admin question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.