AZ-104 Manage Azure Identities and Governance Practice Question
A single Azure virtual machine must read blobs from a storage account without storing any passwords, keys, or connection strings. The identity should be removed automatically if the VM is deleted. Which option should you use?
⚠ Common exam trap
It's easy for candidates to confuse user-assigned managed identities with system-assigned ones, assuming user-assigned identities are also automatically deleted with the VM, when in fact they are independent resources that must be manually cleaned up.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
System-assigned managed identity, because it is tied to that VM.
System-assigned managed identity is tied directly to the lifecycle of the Azure VM. When the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any credentials, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Storage account access key, because it is the simplest authentication method.
Why it's wrong here
While using an access key is often described as the simplest authentication method, it introduces significant secret-management overhead and security risk. The storage account key grants full, unrestricted control over the entire storage account—including blob, container, and account-level operations—so a key placed on the VM becomes a high-value stealable secret. To use it, you must securely inject the key into configuration or environment variables and plan for periodic rotation, making it far less secure and more operationally costly than identity-based access.
When this WOULD be correct
A question that asks for the simplest method to authenticate to a storage account from a VM, with no restrictions on storing keys or automatic identity removal, would make the storage account access key correct.
- ✓
System-assigned managed identity, because it is tied to that VM.
Why this is correct
A system-assigned managed identity creates an Azure AD service principal that is directly tied to the VM's lifecycle; when the VM is deleted, the identity is automatically removed as well. Because it is inherently bound to that specific VM, you can grant it the Storage Blob Data Reader role on the storage account without ever storing a secret on the VM. The VM authenticates via the Azure Instance Metadata Service and receives an Azure AD access token to read blobs securely, with credential rotation handled automatically by the platform.
- ✗
Shared access signature, because it always removes the need for identity management.
Why it's wrong here
A shared access signature (SAS) is a bearer token that delegates limited access for a specific duration, but it does not remove identity management—it replaces it with token generation, permission scoping, expiry tracking, and often stored access policy administration. More importantly, a SAS is not tied to the VM at all; the URL or token can be copied to any client, so it cannot act as a VM-integrated authentication mechanism. The claim that it 'always' removes identity management is false because you must still design, issue, and manage the SAS lifecycle and its permissions.
When this WOULD be correct
A shared access signature would be correct when you need to grant time-limited, delegated access to a storage account for a client that does not support managed identities (e.g., an external application) and you can securely manage the token lifecycle outside the VM.
- ✗
User-assigned managed identity, because it is deleted automatically with the VM.
Why it's wrong here
A user-assigned managed identity is a standalone Azure AD identity that exists independently of any VM, so it is not automatically deleted when a particular VM is removed. It can be assigned to multiple VMs or other Azure resources, which makes it reusable but also means its lifecycle must be actively managed as a separate resource. This is the opposite of a system-assigned identity, whose lifecycle is directly coupled to the VM it belongs to, so the statement in this option is incorrect.
When this WOULD be correct
A user-assigned managed identity would be correct if the question required a single identity to be shared across multiple Azure resources (e.g., multiple VMs and a function app) that all need to access the same storage account, and the identity must remain available even after one VM is deleted.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓System-assigned managed identity, because it is tied to that VM.Correct answer▾
Why this is correct
A system-assigned managed identity creates an Azure AD service principal that is directly tied to the VM's lifecycle; when the VM is deleted, the identity is automatically removed as well. Because it is inherently bound to that specific VM, you can grant it the Storage Blob Data Reader role on the storage account without ever storing a secret on the VM. The VM authenticates via the Azure Instance Metadata Service and receives an Azure AD access token to read blobs securely, with credential rotation handled automatically by the platform.
✗Storage account access key, because it is the simplest authentication method.Wrong answer — click to see why▾
Why this is wrong here
Using a storage account access key requires storing the key in code or configuration, violating the requirement to avoid storing passwords, keys, or connection strings. It also does not automatically remove the identity when the VM is deleted.
★ When this WOULD be the correct answer
A question that asks for the simplest method to authenticate to a storage account from a VM, with no restrictions on storing keys or automatic identity removal, would make the storage account access key correct.
Why candidates choose this
Candidates may think the access key is the easiest and most familiar authentication method, overlooking the security and lifecycle management requirements specified in the question.
✗Shared access signature, because it always removes the need for identity management.Wrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) requires storing a token (key) in the application or configuration, violating the requirement to avoid storing passwords, keys, or connection strings. Additionally, SAS tokens are not automatically removed when the VM is deleted.
★ When this WOULD be the correct answer
A shared access signature would be correct when you need to grant time-limited, delegated access to a storage account for a client that does not support managed identities (e.g., an external application) and you can securely manage the token lifecycle outside the VM.
Why candidates choose this
Candidates may think SAS eliminates the need for identity management because it provides token-based access without requiring a user or service principal, but they overlook the requirement to avoid storing secrets and the automatic cleanup condition.
✗User-assigned managed identity, because it is deleted automatically with the VM.Wrong answer — click to see why▾
Why this is wrong here
A user-assigned managed identity is not automatically deleted when the VM is deleted; it persists independently until explicitly removed. The question requires automatic removal with the VM, which only a system-assigned managed identity provides.
★ When this WOULD be the correct answer
A user-assigned managed identity would be correct if the question required a single identity to be shared across multiple Azure resources (e.g., multiple VMs and a function app) that all need to access the same storage account, and the identity must remain available even after one VM is deleted.
Why candidates choose this
Candidates may confuse user-assigned with system-assigned managed identities, assuming both are automatically deleted with the VM, or they may think user-assigned is more flexible and still meets the deletion requirement.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
System-assigned managed identity
A system-assigned managed identity is an automatically created Azure Active Directory identity that is tied to a specific Azure resource and is used to securely authenticate to other Azure services without storing credentials.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.