A VM-based app must upload invoices to a blob container every hour. Security prohibits storing account keys or SAS tokens on the VM. The app should authenticate with Microsoft Entra ID and be allowed only to write blobs in one container. What should you configure?

Create an account SAS token and store it in the VM's application settings.

An account SAS relies on a shared secret and violates the requirement to avoid storing keys or long-lived tokens on the VM.

Assign Reader on the storage account so the VM can reach the container securely.

Reader is a management-plane role and does not grant permission to upload blob data. It cannot satisfy the write requirement.

Grant Storage Account Contributor at the subscription scope so the app can manage all storage resources.

Storage Account Contributor is far broader than needed and grants management-plane control, not just blob data access. It also violates least privilege.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Enable a managed identity on the VM and assign Storage Blob Data Contributor at the container scope. — A managed identity is the right choice because it eliminates stored secrets on the VM while still allowing the application to authenticate with Microsoft Entra ID. The Storage Blob Data Contributor role is a data-plane role, so it authorizes blob upload operations without granting unnecessary management rights. Scoping the role to the container keeps access tightly limited to the specific data set the app needs. Why others are wrong: An account SAS would require distributing a secret and is specifically what the requirement forbids. Reader is only for viewing Azure resource metadata and cannot write blobs. Storage Account Contributor is excessive because it grants control over storage resources rather than just the container's blob data, which breaks least-privilege design.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.