A team runs a Windows VM in Azure that uploads invoices to a blob container. Security policy forbids storing storage account keys or long-lived SAS tokens on the VM. The app must keep working until the VM is deleted, and access should disappear automatically when the VM is removed. What should the administrator configure?

Create an account SAS token with write permissions and store it in a secure file on the VM.

An account SAS is still a secret that must be stored and protected on the VM. It also remains valid until it expires or is revoked, so access does not automatically end when the VM is deleted. It is broader than necessary for a single application workload.

Assign the Reader role on the storage account to the VM's computer account.

Reader is a management-plane role and does not grant data-plane permissions to upload blobs. The application would still be unable to write files to the container. This choice confuses resource visibility with actual storage data access.

Enable shared key access and rotate the storage account keys regularly.

Shared keys allow broad access and create secret-management overhead. Rotating keys does not bind access to the VM lifecycle and does not provide least privilege. This approach is weaker than using managed identity plus a scoped RBAC role.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container. — Managed identities are the best fit when an Azure workload must access storage without embedded credentials. By assigning the VM a system-assigned managed identity and granting it Storage Blob Data Contributor at the storage account or container scope, the app can upload blobs through Entra ID. Because the identity is deleted with the VM, access ends automatically when the VM is removed, which matches the security requirement. Why others are wrong: SAS tokens and storage keys are secrets that must be stored and managed manually, so they do not satisfy the no-secret and automatic-expiration requirement. Reader is only a management-plane role and cannot upload data. Enabling shared key access increases risk and still leaves the application dependent on long-lived secrets rather than lifecycle-bound identity.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.