AZ-104 Manage Azure Identities and Governance Practice Question
A VM-hosted application must read blobs from an Azure Storage account without storing any secret in code or configuration. Which identity should you enable on the VM?
⚠ Common exam trap
A common mix-up: candidates confuse managed identities with SAS tokens or access keys, thinking they need a shared secret for authentication, but Azure AD authentication with managed identities eliminates the need for any stored credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system-assigned managed identity
A system-assigned managed identity (B) is the correct choice because it allows the VM to authenticate to Azure Storage without storing any credentials in code or configuration. Azure automatically manages the identity's lifecycle and provides a token that the VM can use to access the storage account via Azure AD authentication, eliminating the need for secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A storage account access key
Why it's wrong here
A storage account access key is a static shared secret that grants full control to the entire storage account, including all blobs, tables, and queues, with no ability to scope privileges to just the required container. The application must securely store the key somewhere (e.g., environment variables, config files, or a vault) and rotation requires modifying the application, increasing operational overhead and exposure risk if leaked.
When this WOULD be correct
When the question explicitly allows storing secrets in code or configuration, or when the requirement is to use the most straightforward method for authentication without considering secret management best practices.
- ✓
A system-assigned managed identity
Why this is correct
A system-assigned managed identity is tied to the VM and lets the application authenticate to Azure services without storing credentials. Azure can issue tokens for the identity automatically, and the identity is removed when the VM is deleted. This is the simplest credential-free option for a single VM that needs access to Storage or other Azure resources.
- ✗
A shared access signature (SAS) token
Why it's wrong here
A shared access signature (SAS) token limits permissions and validity, but it is still a credential that must be generated, embedded in the connection string or URL, and then stored by the application. It also has an expiry, so the application must handle token renewal, often by requesting a new token from a service that itself possesses the account key—reintroducing secret management that managed identity eliminates.
When this WOULD be correct
When the question specifies that the application can securely store a token (e.g., in Azure Key Vault) and needs fine-grained, time-limited access to specific blobs without using managed identities.
- ✗
A local administrator account on the VM
Why it's wrong here
A local administrator account on the VM only authenticates the user to the operating system and has no meaning in Azure Storage's authentication context. Azure Blob Storage does not recognize any VM-local user or group, so this credential cannot be used to request tokens or authorize access to blob resources; it is an entirely unrelated access-control domain.
When this WOULD be correct
If the question asked for accessing the VM itself (e.g., RDP or remote management) without storing secrets in code, enabling a local admin account would be correct, but for Azure Storage access it is not.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A system-assigned managed identityCorrect answer▾
Why this is correct
A system-assigned managed identity is tied to the VM and lets the application authenticate to Azure services without storing credentials. Azure can issue tokens for the identity automatically, and the identity is removed when the VM is deleted. This is the simplest credential-free option for a single VM that needs access to Storage or other Azure resources.
✗A storage account access keyWrong answer — click to see why▾
Why this is wrong here
A storage account access key grants full control over the storage account and must be stored in code or configuration, violating the requirement to avoid storing secrets.
★ When this WOULD be the correct answer
When the question explicitly allows storing secrets in code or configuration, or when the requirement is to use the most straightforward method for authentication without considering secret management best practices.
Why candidates choose this
Candidates may think access keys are the standard way to authenticate, overlooking the security requirement to avoid storing secrets.
✗A shared access signature (SAS) tokenWrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) token is a secret that must be stored in code or configuration, which contradicts the requirement to avoid storing secrets.
★ When this WOULD be the correct answer
When the question specifies that the application can securely store a token (e.g., in Azure Key Vault) and needs fine-grained, time-limited access to specific blobs without using managed identities.
Why candidates choose this
Candidates may think SAS tokens are secure because they can be scoped and expired, overlooking that they still require secret management in code or config.
✗A local administrator account on the VMWrong answer — click to see why▾
Why this is wrong here
A local administrator account on the VM cannot authenticate to Azure Storage; it only provides local OS access, not Azure resource access.
★ When this WOULD be the correct answer
If the question asked for accessing the VM itself (e.g., RDP or remote management) without storing secrets in code, enabling a local admin account would be correct, but for Azure Storage access it is not.
Why candidates choose this
Candidates may confuse local VM identity with Azure identity, thinking a local admin can be used to access Azure resources via some implicit trust.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
System-assigned managed identity
A system-assigned managed identity is an automatically created Azure Active Directory identity that is tied to a specific Azure resource and is used to securely authenticate to other Azure services without storing credentials.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.