Design security solutions for applications and data · Topic 3 of 5
Workload Identities, API Management and WAF
SC-100 app protection: managed identities, workload identity federation, Conditional Access for workloads, API Management, Defender for APIs and WAF.
- 6 min
- Includes a diagram
- Managed identities (system or user assigned), federation and certificates beat secrets. Give each app its own least privilege identity.
- Conditional Access for workload identities applies to single tenant service principals and uses location and risk.
- APIM:
validate-jwt, rate limiting, request validation, IP filter, managed identity to backends, virtual network.
What it is
Three layers protect a running application. Workload identities give the application a safe way to authenticate to Azure and other services without secrets. API management controls who can call the application's APIs and how. A Web Application Firewall (WAF) filters malicious web traffic before it reaches the app.
How it works
Workload identities
A workload identity is an identity for software, not a person: an application, service, script or container that needs to access resources.
| Option | Details |
|---|---|
| Managed identity (system assigned or user assigned) | Azure manages the credential. Use for code running in Azure (App Service, Functions, VMs, AKS, Container Apps). System assigned is tied to one resource. User assigned is a standalone resource that can be reused and survives deletion of a resource |
| Service principal (app registration) | For apps outside Azure. Prefer certificate or federated credentials over client secrets, and use short lifetimes |
| Workload identity federation | Trust a token from an external identity provider (GitHub Actions, Kubernetes, other clouds, Google) so the workload gets Azure access with no stored secret |
| Microsoft Entra Workload ID for Kubernetes | Lets pods use Entra identities through federation |
Design guidance:
- Prefer managed identities, then federation, then certificates, and last of all secrets.
- Give each application its own identity and the least privilege Azure RBAC role at the narrowest scope.
- Do not reuse one identity across unrelated apps.
- Review and clean up app registrations: owners, expiring credentials, unused permissions, and stale apps.
- Use Conditional Access for workload identities (with the workload identities premium license): apply location and risk based policies to service principals so a stolen credential cannot be used from an unexpected network. It applies to single tenant service principals, not managed identities.
- Continuous access evaluation for workload identities lets critical events, such as a disabled service principal, take effect quickly for supporting resources.
- Monitor service principal sign in logs and ID Protection detections for workload identities.
API management and security
Azure API Management (APIM) is a gateway in front of backend APIs. Use it to apply security consistently.
| Control | How |
|---|---|
| Authentication and authorization | Validate OAuth 2.0 and OpenID Connect tokens with the validate-jwt policy (issuer, audience, claims). Use subscription keys only for identifying and metering consumers, not as the only security |
| Throttling and quotas | rate-limit and quota policies to limit abuse and denial of service |
| Request validation | Validate content, headers and parameters against the API schema |
| IP filtering | Allow or deny specific callers |
| Backend authentication | APIM uses a managed identity to call backends, or client certificates, so backends accept calls only from the gateway |
| Network isolation | Deploy in a virtual network (internal or external mode) and use private endpoints so the backend has no public path |
| TLS | Enforce modern TLS protocols and ciphers |
| Secrets | Named values stored in Key Vault |
| Developer portal access | Control who can see and subscribe to APIs |
| Logging | Send gateway logs to Azure Monitor, Application Insights and Sentinel |
Microsoft Defender for APIs (a Defender for Cloud plan) gives API inventory, finds unauthenticated or dormant APIs, detects anomalous and malicious usage at run time and shows sensitive data exposure, for APIs published through API Management. Align designs with the OWASP API Security Top 10, such as broken object level authorization, broken authentication, excessive data exposure and unrestricted resource consumption.
Azure Web Application Firewall (WAF)
A WAF inspects HTTP and HTTPS requests and blocks common attacks such as SQL injection, cross site scripting and bad bots. Azure offers WAF on several services.
| Where | Scope and use |
|---|---|
| Azure Application Gateway WAF (v2) | Regional. Good for applications in one region, including internal apps through a private frontend. Per site, per listener and per URI policies |
| Azure Front Door WAF | Global edge. Good for multi region and internet facing apps. Also gives acceleration and rate limiting at the edge. Available in Standard and Premium tiers |
| Azure CDN with WAF | Edge protection when using a Microsoft CDN |
Key WAF concepts:
- Modes: Detection (log only, to tune) and Prevention (block).
- Managed rule sets: the Default Rule Set (DRS), based on OWASP core rules, plus bot protection rules.
- Custom rules: match conditions on IP, geography, headers, query strings and more, with allow, block or log actions, and rate limiting.
- Exclusions to avoid false positives for legitimate traffic, added carefully.
- Logs to Log Analytics and Sentinel, and metrics for tuning.
- Combine with DDoS Protection for volumetric attacks, and keep the origin reachable only through the WAF or Front Door (restrict origin access with the Front Door service tag and header ID, or a private link origin).
| Requirement | Choice |
|---|---|
| Internal HR portal, one region, lowest cost WAF | Application Gateway WAF v2 with a private frontend |
| Global public site across regions | Front Door Premium with WAF |
| Block abusive clients by rate | WAF custom rate limit rule |
| Protect an API in APIM from injection | WAF in front of APIM, plus APIM policies |
| Tune out false positives safely | Start in Detection mode, review logs, add targeted exclusions |
A worked scenario
A partner facing API runs on Azure Functions behind API Management. The architect specifies a user assigned managed identity for the functions to reach Key Vault and SQL, APIM with validate-jwt, rate limits and an internal virtual network deployment, Application Gateway WAF v2 in front in Prevention mode, Defender for APIs for runtime detection, and Conditional Access for workload identities on the partner integration service principal to restrict its sign in location.
What to remember for the exam
- Managed identities (system or user assigned), federation and certificates beat secrets. Give each app its own least privilege identity.
- Conditional Access for workload identities applies to single tenant service principals and uses location and risk.
- APIM:
validate-jwt, rate limiting, request validation, IP filter, managed identity to backends, virtual network. - Defender for APIs gives inventory and runtime threat detection. Use OWASP API Top 10 as a guide.
- WAF: Application Gateway (regional, supports private frontend), Front Door (global). Detection versus Prevention, DRS, custom rules, rate limiting.
"Lowest cost WAF for an internal single region app" is Application Gateway WAF v2 with a private frontend, not Front Door.
How the exam asks about this
- "Authenticate a GitHub workflow to Azure without secrets." Workload identity federation.
- "Restrict a service principal to sign in from known IP ranges." Conditional Access for workload identities with a location condition.
- "Validate access tokens and limit request rates on an API." API Management policies.
- "Find APIs with no authentication." Defender for APIs inventory.
Common mistakes
Subscription keys as the only API security. They identify callers but are weak authentication.
Public backends behind APIM. Restrict the backend to the gateway.
WAF in Detection mode forever. It logs but does not block.
Sharing one identity across apps. One compromise exposes everything it can reach.
Check yourself
Which managed identity type can be shared by several resources?
User assigned.
Which APIM policy validates an OAuth 2.0 access token?
validate-jwt.
Which WAF mode actually blocks attacks?
Prevention mode.
Topic 3 of 5 in Design security solutions for applications and data
Test yourself on Design security solutions for applications and data
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.