AZ-104 Manage Azure Identities and Governance Practice Question
A team operates two Azure VMs that both need to call Azure services with the same identity. The VMs are rebuilt frequently, and the identity must continue to work if either VM is deleted and recreated. Which identity should the administrator attach?
⚠ Common exam trap
Test-takers frequently confuse system-assigned and user-assigned managed identities, assuming a system-assigned identity can be shared or persist after VM deletion, when in fact only user-assigned identities are decoupled from the VM lifecycle and can be attached to multiple resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A user-assigned managed identity attached to both VMs
A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be attached to multiple VMs. When a VM is deleted and recreated, the identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure services without credential management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A system-assigned managed identity on one of the VMs
Why it's wrong here
A system-assigned managed identity is permanently tied to the specific VM on which it is enabled, so it cannot be replicated or shared with any other resource. If you attempt to use only one VM's system-assigned identity for both VMs, the second VM is issuing requests with a different principal, not the same identity. Additionally, this identity is deleted automatically when the VM is deleted, making it unsuitable when the identity must outlive a single VM or be used uniformly across several VMs.
When this WOULD be correct
A question where only one VM needs an identity, and the VM is never deleted (or the identity is recreated automatically when the VM is recreated), and there is no requirement for the identity to survive VM deletion or be shared.
- ✓
A user-assigned managed identity attached to both VMs
Why this is correct
A user-assigned managed identity is an Azure AD identity that exists independently of any VM. It can be assigned to multiple VMs at once, allowing both VMs to share the same identity and request tokens for the same resources. Because Azure manages the credentials automatically, there are no secrets to store on the VMs, and the identity survives VM deletion or recreation. This directly satisfies the requirement of shared identity without stored credentials.
- ✗
A service principal with a client secret stored on each VM
Why it's wrong here
A service principal with a client secret stored on each VM forces you to place and manage secrets on every machine, which conflicts with the requirement to avoid stored credentials. Each VM would need its own copy of the secret, creating distribution, rotation, and protection overhead, and a leaked secret compromises the shared identity. While this approach does technically work for authentication, it reintroduces the exact operational and security risks that managed identities are designed to eliminate.
When this WOULD be correct
This option would be correct in a scenario where the VMs are long-lived, not frequently rebuilt, and the administrator needs to use the same identity for on-premises or multi-cloud resources that do not support managed identities, requiring explicit credential storage.
- ✗
A certificate uploaded to each VM and used for Azure sign-in
Why it's wrong here
Uploading a certificate to each VM and using it for Azure sign-in still requires you to distribute, renew, and protect private key material on every VM, creating significant lifecycle management overhead. Unlike a managed identity, the certificate-based approach is not automatically integrated with Azure's IMDS endpoint, so you must custom code the authentication flow and handle certificate expiration manually. The certificate also represents a stored credential on each VM, which does not satisfy the no-stored-credentials requirement.
When this WOULD be correct
A question where the requirement is to authenticate to Azure services using a certificate-based service principal, and the VMs are long-lived (not frequently rebuilt), with no need for automatic identity continuity across VM deletion/recreation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A user-assigned managed identity attached to both VMsCorrect answer▾
Why this is correct
A user-assigned managed identity is an Azure AD identity that exists independently of any VM. It can be assigned to multiple VMs at once, allowing both VMs to share the same identity and request tokens for the same resources. Because Azure manages the credentials automatically, there are no secrets to store on the VMs, and the identity survives VM deletion or recreation. This directly satisfies the requirement of shared identity without stored credentials.
✗A system-assigned managed identity on one of the VMsWrong answer — click to see why▾
Why this is wrong here
A system-assigned managed identity is tied to the lifecycle of a single VM. If that VM is deleted, the identity is also deleted, so it cannot persist across VM recreations or be shared with another VM.
★ When this WOULD be the correct answer
A question where only one VM needs an identity, and the VM is never deleted (or the identity is recreated automatically when the VM is recreated), and there is no requirement for the identity to survive VM deletion or be shared.
Why candidates choose this
Candidates may think system-assigned managed identity is simpler and sufficient, overlooking the requirement for identity persistence across VM deletion and sharing between two VMs.
✗A service principal with a client secret stored on each VMWrong answer — click to see why▾
Why this is wrong here
A service principal with a client secret stored on each VM requires manual secret management and rotation; if a VM is deleted, the secret is lost, and the identity cannot persist across VM recreations without manual intervention.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the VMs are long-lived, not frequently rebuilt, and the administrator needs to use the same identity for on-premises or multi-cloud resources that do not support managed identities, requiring explicit credential storage.
Why candidates choose this
Candidates may think a service principal is the standard way to provide an identity for Azure services, and storing the secret on each VM seems straightforward, overlooking the management overhead and lack of resilience to VM deletion.
✗A certificate uploaded to each VM and used for Azure sign-inWrong answer — click to see why▾
Why this is wrong here
Certificates uploaded to each VM are not managed identities; they require manual rotation and secure storage, and if a VM is deleted and recreated, the certificate must be re-uploaded, breaking the identity continuity.
★ When this WOULD be the correct answer
A question where the requirement is to authenticate to Azure services using a certificate-based service principal, and the VMs are long-lived (not frequently rebuilt), with no need for automatic identity continuity across VM deletion/recreation.
Why candidates choose this
Candidates may think certificates provide a secure, persistent identity that can be reused, but they overlook the operational overhead and lack of automatic lifecycle management compared to managed identities.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
User-assigned managed identity
A user-assigned managed identity is a standalone Azure identity that can be assigned to one or more Azure resources, enabling them to authenticate to other services without storing credentials.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Three VMs run the same batch app and should use the same Azure identity to read blobs. The identity should remain available even if one VM is deleted. Which identity should you use?
easy- A.Shared access signature (SAS) token
- B.System-assigned managed identity
- ✓ C.User-assigned managed identity
- D.Storage account shared key
Why C: C is correct because a user-assigned managed identity is an independent Azure resource that persists even if a specific VM is deleted. This allows multiple VMs to share the same identity to authenticate to Azure Blob Storage, ensuring continuous access to blobs as long as at least one VM remains.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.