A team runs a Windows service on an Azure virtual machine that uploads invoices to Blob storage every few minutes. Security policy forbids storing account keys or long-lived SAS tokens on the VM. The service must authenticate without human interaction. What should the administrator configure?

Generate a SAS token with a 1-year expiry and store it in an encrypted file on the VM.

A long-lived SAS still becomes a reusable secret on the VM, which violates the policy and increases exposure if the host is compromised.

Share the storage account access key with the service account and rotate it monthly.

The access key is a high-risk credential that grants broad access to the storage account and must not be stored on the VM under this policy.

Create a storage firewall rule that allows the VM's public IP address and keep using anonymous access.

A firewall rule only controls network reachability. It does not provide authentication for blob uploads, and anonymous access would be insecure and generally disabled.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Assign the VM a managed identity and grant it Storage Blob Data Contributor on the container or storage account. — A managed identity is the best choice because it removes the need to store secrets on the VM. The identity can request an access token from Entra ID at runtime, and RBAC grants only the required blob data permissions. This is the standard Azure approach for secure, automated access from compute to storage when credentials must not be embedded or managed manually. Why others are wrong: A still uses a long-lived secret, which the policy explicitly forbids. C uses a storage account key, which is even broader in scope than a SAS and should not be stored on the VM. D only affects network access and does not replace authentication, so the service would still be unable to upload blobs securely.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.