AZ-104 Manage Azure Identities and Governance Practice Question
A build server hosted in a company datacenter must deploy ARM templates to a target resource group in Azure without storing a user password. The server is not running in Azure, and the team wants to authorize deployments with Azure RBAC. What should be configured?
⚠ Common exam trap
Watch out — candidates often confuse managed identities (which are Azure-only) with service principals, or mistakenly think a SAS token can be used for RBAC-based ARM deployments, when SAS is strictly for Storage access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service principal authenticated with a certificate and assigned RBAC on the target scope
A service principal authenticated with a certificate is the correct approach because it allows non-Azure resources (like an on-premises build server) to authenticate to Azure without storing a user password. The certificate-based authentication satisfies the requirement to avoid storing a password, and assigning RBAC on the target resource group grants the service principal the necessary permissions to deploy ARM templates. This method is secure, supports automation, and aligns with Azure AD application registration best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A service principal authenticated with a certificate and assigned RBAC on the target scope
Why this is correct
A service principal with a certificate is an Azure AD identity designed for non-interactive workloads, and because the certificate (not a password) proves its identity, it can authenticate from any machine, including an on-premises build server. After you assign it RBAC permissions, such as Contributor on the target resource group, that identity can deploy ARM templates via the Azure management plane without requiring interactive sign-in or storing credentials.
- ✗
A system-assigned managed identity on the build server
Why it's wrong here
System-assigned managed identities are created by Azure on an Azure resource such as a virtual machine or App Service, so they cannot exist on an on-premises server to authenticate against Azure AD. Since the build server is not an Azure resource, it has no way to obtain the managed identity token that would be used for authorization.
When this WOULD be correct
If the build server were an Azure VM or Azure App Service, a system-assigned managed identity could be used to authenticate to Azure without storing credentials, and RBAC could be assigned to that identity.
- ✗
A personal user account with multifactor authentication
Why it's wrong here
A personal user account with MFA is problematic for automation because the MFA challenge requires interactive human input, preventing a build server from authenticating unattended. Even if you tried to store the password, doing so contradicts the requirement to avoid user-password storage, and conditional access policies often block legacy non-interactive flows for MFA-enabled accounts.
When this WOULD be correct
If the question asked for a method to deploy ARM templates interactively from a developer workstation with enhanced security, a personal account with MFA would be correct, as it protects the user's credentials and requires second-factor authentication.
- ✗
A shared access signature for the resource group
Why it's wrong here
A shared access signature is an authorization mechanism for Azure Storage data-plane operations (e.g., blobs, queues, tables), not for the Azure control plane that processes ARM template deployments. It cannot be used to authorize creating, updating, or deleting resources in a resource group, and its delegated tokens are scoped to a storage account or container, never to an entire resource group.
When this WOULD be correct
A question asks: 'You need to grant a client application temporary access to a specific blob in Azure Storage without exposing the storage account key. What should you use?' In this case, a shared access signature would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A service principal authenticated with a certificate and assigned RBAC on the target scopeCorrect answer▾
Why this is correct
A service principal with a certificate is an Azure AD identity designed for non-interactive workloads, and because the certificate (not a password) proves its identity, it can authenticate from any machine, including an on-premises build server. After you assign it RBAC permissions, such as Contributor on the target resource group, that identity can deploy ARM templates via the Azure management plane without requiring interactive sign-in or storing credentials.
✗A system-assigned managed identity on the build serverWrong answer — click to see why▾
Why this is wrong here
The build server is not running in Azure, so it cannot use a system-assigned managed identity, which is only available for Azure resources like VMs or App Services.
★ When this WOULD be the correct answer
If the build server were an Azure VM or Azure App Service, a system-assigned managed identity could be used to authenticate to Azure without storing credentials, and RBAC could be assigned to that identity.
Why candidates choose this
Candidates may confuse managed identities with service principals, thinking that managed identities can be used from any server, not just Azure-hosted resources.
✗A personal user account with multifactor authenticationWrong answer — click to see why▾
Why this is wrong here
A personal user account with MFA cannot be used for automated, non-interactive deployments from a build server because MFA requires interactive user login, and the scenario explicitly prohibits storing a user password.
★ When this WOULD be the correct answer
If the question asked for a method to deploy ARM templates interactively from a developer workstation with enhanced security, a personal account with MFA would be correct, as it protects the user's credentials and requires second-factor authentication.
Why candidates choose this
Candidates may think MFA provides sufficient security for automated deployments, overlooking that MFA requires interactive human presence, which is not feasible for unattended build server operations.
✗A shared access signature for the resource groupWrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) is used to delegate access to Azure Storage resources, not to authorize ARM template deployments. It does not support RBAC or authentication for Azure Resource Manager operations.
★ When this WOULD be the correct answer
A question asks: 'You need to grant a client application temporary access to a specific blob in Azure Storage without exposing the storage account key. What should you use?' In this case, a shared access signature would be the correct answer.
Why candidates choose this
Candidates may confuse SAS with a secure way to grant access to Azure resources, not realizing it is limited to storage services and cannot be used for ARM template deployment authorization.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which identity type should be used so the on-premises build server can authenticate to Azure without using a human account password?
easy- A.System-assigned managed identity
- B.User-assigned managed identity
- ✓ C.Service principal
- D.Azure Storage access key
Why C: A service principal is the correct identity type for an on-premises build server to authenticate to Azure without a human account password because it represents a non-human identity that can be assigned to applications, services, and automation tools. Service principals authenticate using client secrets or certificates, enabling secure, password-less authentication via OAuth 2.0 client credentials grant flow, which is ideal for automated build pipelines.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.