AZ-104 Implement and Manage Storage Practice Question
A DevOps pipeline runs on an on-premises build server and must deploy ARM templates to a resource group in Azure without using a user password. The server is not in Azure, so managed identity is not available. What should the administrator create?
⚠ Common exam trap
Watch out — candidates often assume managed identities can be used on any server, but Azure restricts them to Azure-hosted resources, forcing the use of service principals for on-premises scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service principal for the pipeline, with certificate-based or federated authentication.
The on-premises build server cannot use Azure managed identities (which require an Azure resource). Instead, a service principal with certificate-based or federated authentication provides a secure, passwordless identity for the pipeline to authenticate to Azure AD and deploy ARM templates. This aligns with the principle of using Azure AD application credentials for non-Azure workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A system-assigned managed identity on the build server.
Why it's wrong here
A system-assigned managed identity is a built-in Azure AD identity that is automatically created for a specific Azure resource, such as a virtual machine, App Service, or Azure Function. The identity is tied to the resource's lifecycle and can only be used by that resource via the Azure Instance Metadata Service (IMDS) endpoint. An on-premises build server is not an Azure resource and cannot host or use this identity, as there is no Azure-managed infrastructure to provide tokens from IMDS. Thus, this approach fails for a DevOps pipeline running outside Azure.
When this WOULD be correct
If the build server were an Azure VM, a system-assigned managed identity could be used to authenticate to Azure resources without passwords, enabling secure ARM template deployment.
- ✗
A user-assigned managed identity attached to the on-premises server.
Why it's wrong here
A user-assigned managed identity is a standalone Azure AD identity that can be assigned to multiple Azure resources, but it still must be attached to an Azure-supported resource like a VM, VMSS, or Azure Container Instance. Assignment requires the Azure Resource Manager to provision the identity's credentials to the resource's factory, and the resource obtains tokens by calling the local managed identity endpoint (IMDS). An on-premises server lacks this endpoint and is not a resource type that ARM can assign the identity to, so merely 'attaching' the identity to an on-premises server is impossible. You would need to run the pipeline in Azure to use any managed identity.
When this WOULD be correct
A user-assigned managed identity would be correct if the build server were an Azure VM or Azure Arc-enabled server, and the pipeline needed to authenticate to Azure without managing credentials.
- ✓
A service principal for the pipeline, with certificate-based or federated authentication.
Why this is correct
An on-premises build server cannot use Azure managed identity directly, so the correct approach is to create a service principal and grant it the required RBAC permissions. Using certificate-based or federated authentication avoids storing a user password and supports secure non-interactive deployment from outside Azure.
- ✗
A shared access signature for the target resource group.
Why it's wrong here
A shared access signature (SAS) is a delegation mechanism designed specifically for Azure Storage resources, such as blobs, queues, and tables, granting time-limited permission to perform operations on that storage data. It is not an Azure AD identity and cannot authenticate against the Azure Resource Manager (ARM) API, which is what the pipeline uses to create or update resources in a resource group. Therefore, a SAS token would be useless for deploying ARM templates or calling ARM endpoints for Azure resource deployment. The pipeline needs an Azure AD principal (service principal) with RBAC permissions on the target scope, not a storage-level SAS.
When this WOULD be correct
A shared access signature would be correct if the question asked for secure access to a storage account (e.g., to allow an on-premises server to upload files to a blob container) without using a password or managed identity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A service principal for the pipeline, with certificate-based or federated authentication.Correct answer▾
Why this is correct
An on-premises build server cannot use Azure managed identity directly, so the correct approach is to create a service principal and grant it the required RBAC permissions. Using certificate-based or federated authentication avoids storing a user password and supports secure non-interactive deployment from outside Azure.
✗A system-assigned managed identity on the build server.Wrong answer — click to see why▾
Why this is wrong here
Managed identities are an Azure feature that cannot be assigned to on-premises servers; they only work for Azure resources like VMs or App Services. The build server is not in Azure, so a managed identity is not applicable.
★ When this WOULD be the correct answer
If the build server were an Azure VM, a system-assigned managed identity could be used to authenticate to Azure resources without passwords, enabling secure ARM template deployment.
Why candidates choose this
Candidates may confuse managed identities with service principals, thinking they can be used for non-Azure resources, or they may overlook the constraint that the server is on-premises.
✗A user-assigned managed identity attached to the on-premises server.Wrong answer — click to see why▾
Why this is wrong here
Managed identities are an Azure feature that cannot be assigned to on-premises servers; they only work with Azure resources like VMs or App Services. The question explicitly states the server is not in Azure.
★ When this WOULD be the correct answer
A user-assigned managed identity would be correct if the build server were an Azure VM or Azure Arc-enabled server, and the pipeline needed to authenticate to Azure without managing credentials.
Why candidates choose this
Candidates may confuse managed identities with service principals, thinking they can be applied to any server, or they may overlook the constraint that the server is on-premises and not Azure-based.
✗A shared access signature for the target resource group.Wrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) provides delegated access to Azure Storage resources, not to ARM template deployment. It cannot authenticate to Azure Resource Manager for deploying templates to a resource group.
★ When this WOULD be the correct answer
A shared access signature would be correct if the question asked for secure access to a storage account (e.g., to allow an on-premises server to upload files to a blob container) without using a password or managed identity.
Why candidates choose this
Candidates may confuse SAS with a general Azure authentication mechanism, thinking it can grant access to any Azure resource, or they may incorrectly assume SAS can be used for ARM template deployment.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.