Security Operations¶

This guide covers daily and periodic security operations: managed identity lifecycle, secret rotation, and Easy Auth policy management.

Prerequisites¶

• A user-assigned or system-assigned managed identity strategy
• Secret owners and rotation intervals documented

export RG="rg-myapp"
export APP_NAME="ca-myapp"
export ACA_ENV_NAME="cae-myapp"

Managed Identity Operations¶

Enable system-assigned managed identity:

flowchart TD
    A[Container App] --> B[Managed Identity]
    B --> C[Microsoft Entra ID]
    C --> D[Access Token]
    D --> E[Key Vault/Storage/SQL]

az containerapp identity assign \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --system-assigned

Check principal details:

az containerapp identity show \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --output json

Example output (PII masked):

{
  "type": "SystemAssigned",
  "principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "tenantId": "<tenant-id>"
}

Grant least-privilege role assignment:

az role assignment create \
  --assignee-object-id "<object-id>" \
  --assignee-principal-type ServicePrincipal \
  --role "Key Vault Secrets User" \
  --scope "/subscriptions/<subscription-id>/resourceGroups/$RG/providers/Microsoft.KeyVault/vaults/<key-vault-name>"

Secret Operations¶

Set or rotate secret values in Container Apps configuration:

az containerapp secret set \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --secrets "db-connection=<redacted-secret>"

Reference the secret as an environment variable in app template updates.

Security Operations Cadence¶

Portal view: Access control (IAM) blade¶

[Observed] The blade header reads ca-sample-d38538 | Access control (IAM) with the subtitle Container App. The command bar exposes + Add, Download role assignments, Edit columns, Refresh, Delete, and Feedback controls. Four tabs are rendered: Check access (selected), Role assignments, Roles, and Deny assignments. The selected tab shows a My access section with a View my access button, a Check access section with a Check access button, and three cards titled Grant access to this resource (with an Add role assignment button), View access to this resource (with a View button), and View deny assignments (with a View button). The left navigation lists Overview, Activity log, Access control (IAM) (highlighted), Tags, Diagnose and solve problems, Resource visualizer, and grouped sections for Application, Settings, Networking, Security, Monitoring, Automation, and Help.

[Inferred] The four tabs (Check access, Role assignments, Roles, Deny assignments) and the three cards (Grant access, View access, View deny assignments) appear to map to the RBAC scope-audit cadence described in the table above. The + Add command and the Add role assignment card button are consistent with the role-creation surface invoked by az role assignment create shown in the Managed Identity Operations section.

[Not Proven] The screenshot does not include any Role assignments tab content, so the captured surface does not reveal which principals or roles are bound to this Container App. The Check access and View my access buttons are present but their result panels are not visible in this capture, so the rendered shape of those panels is outside the scope of this image.

Easy Auth Operations¶

Review and enforce authentication settings:

az containerapp auth show \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --output json

Update auth to require login by default:

az containerapp auth update \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --enabled true \
  --unauthenticated-client-action Return401

Verification Steps¶

az containerapp show \
  --name "$APP_NAME" \
  --resource-group "$RG" \
  --query "{identity:identity,auth:properties.configuration.auth}" \
  --output json

Example output (PII masked):

{
  "identity": {
    "type": "SystemAssigned",
    "principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "tenantId": "<tenant-id>"
  },
  "auth": {
    "platform": {
      "enabled": true
    }
  }
}

Troubleshooting¶

Managed identity token requests fail¶

• Confirm identity is assigned to the app.
• Verify target resource role assignment scope.
• Wait for RBAC propagation, then retry.

Easy Auth blocks expected traffic¶

• Validate allowed redirect URI and issuer configuration.
• Exclude health endpoints from auth if required by probes.

Advanced Topics¶

• Use user-assigned identities for shared access policies.
• Rotate secrets via Key Vault references and automation.
• Add policy enforcement with Azure Policy for auth and identity baselines.

See Also¶

• Networking
• Observability
• Managed Identity Recipe
• Easy Auth Recipe

Sources¶

• Container Apps security
• Managed identity in Azure Container Apps (Microsoft Learn)