AZ-104 Manage Azure Identities and Governance Practice Question
A VM-hosted application must read blobs from Azure Storage without storing any keys or passwords. Which two identity types can the VM use to authenticate to Azure Storage? Select two.
⚠ Common exam trap
Many exam-takers confuse managed identities with shared access signatures (SAS) or shared keys, thinking that any identity-based method requires storing a secret, or they incorrectly assume that anonymous access is a valid identity type for application authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
System-assigned managed identity, because it is tied to one VM and can request tokens without stored secrets.
System-assigned managed identity is correct because it is directly tied to a single VM and can request tokens from Azure AD without storing any secrets or keys. The VM uses its managed identity to authenticate to Azure Storage by obtaining an OAuth 2.0 token, which is then passed to the storage service via the Authorization header. This eliminates the need for any stored credentials, meeting the requirement of not storing keys or passwords.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
System-assigned managed identity, because it is tied to one VM and can request tokens without stored secrets.
Why this is correct
System-assigned managed identity is an Azure AD service principal that is automatically created when the VM is provisioned and deleted when the VM is deleted. The application obtains a token by calling the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254, so no connection strings or keys are ever stored in code or configuration. You assign RBAC, such as Storage Blob Data Reader, to that identity for the storage account, and Azure automatically rotates the underlying credentials.
- ✓
User-assigned managed identity, because it can be reused by multiple resources without embedding credentials.
Why this is correct
A user-assigned managed identity exists as a standalone Azure AD identity that can be assigned to multiple VMs or other Azure resources. Like the system-assigned type, it enables token-based, secretless authentication to Azure Storage because the VM's identity can request tokens via IMDS without embedding any credential. Its key advantage is lifecycle independence—you can reassign it after a VM is deleted—and it is ideal when several VMs must share the same identity to access the same blob container.
- ✗
Storage account shared key, because it is the preferred credential when you want to avoid passwords.
Why it's wrong here
The storage account shared key is a 512-bit secret that, when used to sign an Authorization header, grants full administrative access to the entire storage account—all blobs, tables, queues, and files. It is effectively a root password that must be stored in configuration, environment variables, or Key Vault, violating the no-secrets requirement. Moreover, key rotation requires updating every application that uses it, and a leaked key exposes all data, unlike a scoped RBAC role tied to a managed identity.
When this WOULD be correct
A question that asks for the simplest way to authenticate a script running on an on-premises server to Azure Storage, where storing a key is acceptable and managed identities are not available.
- ✗
Basic authentication with a storage account name and password, because Azure Storage supports that model directly.
Why it's wrong here
Azure Storage does not implement HTTP Basic authentication with a username and password. Storage account names are not treated as usernames; instead, authentication uses Azure AD tokens, shared keys, or shared access signatures (SAS). There is also no such thing as a 'storage account password' in the Azure platform, so this option misrepresents how the service works. Attempting to use basic authentication would fail because the Storage REST API has no endpoint that accepts plain credentials for blob reads.
When this WOULD be correct
In a scenario where a legacy application requires simple username/password authentication and the storage account is configured to allow basic auth (e.g., using Azure AD with password grant), but this is not standard for Azure Storage.
- ✗
Anonymous public access, because it lets the VM read blobs without any authentication at all.
Why it's wrong here
Anonymous public access is configured by setting the container's public access level to Blob or Container in Azure Storage. This allows any unauthenticated client—including anyone on the internet—to read blobs using the blob's public URL, completely bypassing Azure AD, RBAC, and any request signing. It is appropriate only for deliberately public assets, such as static website images, and using it for a VM-hosted application would expose the stored data to the entire world with no access control.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓System-assigned managed identity, because it is tied to one VM and can request tokens without stored secrets.Correct answer▾
Why this is correct
System-assigned managed identity is an Azure AD service principal that is automatically created when the VM is provisioned and deleted when the VM is deleted. The application obtains a token by calling the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254, so no connection strings or keys are ever stored in code or configuration. You assign RBAC, such as Storage Blob Data Reader, to that identity for the storage account, and Azure automatically rotates the underlying credentials.
✗Storage account shared key, because it is the preferred credential when you want to avoid passwords.Wrong answer — click to see why▾
Why this is wrong here
The question requires the VM to authenticate without storing keys or passwords, but a storage account shared key is a secret that must be stored on the VM, violating the requirement.
★ When this WOULD be the correct answer
A question that asks for the simplest way to authenticate a script running on an on-premises server to Azure Storage, where storing a key is acceptable and managed identities are not available.
Why candidates choose this
Candidates may think shared keys are secure because they are not passwords, but they are still secrets that need to be stored, and the question explicitly forbids storing any keys or passwords.
✗Basic authentication with a storage account name and password, because Azure Storage supports that model directly.Wrong answer — click to see why▾
Why this is wrong here
Azure Storage does not support basic authentication with a storage account name and password; it uses shared keys or tokens. The question requires avoiding stored secrets, and basic authentication would still require embedding a password.
★ When this WOULD be the correct answer
In a scenario where a legacy application requires simple username/password authentication and the storage account is configured to allow basic auth (e.g., using Azure AD with password grant), but this is not standard for Azure Storage.
Why candidates choose this
Candidates may confuse Azure Storage authentication with other Azure services that support basic auth, or mistakenly think that storage account name and key are analogous to username and password.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
System-assigned managed identity
A system-assigned managed identity is an automatically created Azure Active Directory identity that is tied to a specific Azure resource and is used to securely authenticate to other Azure services without storing credentials.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A VM-hosted application must read blobs from an Azure Storage account without storing any secret in code or configuration. Which identity should you enable on the VM?
easy- A.A storage account access key
- ✓ B.A system-assigned managed identity
- C.A shared access signature (SAS) token
- D.A local administrator account on the VM
Why B: A system-assigned managed identity (B) is the correct choice because it allows the VM to authenticate to Azure Storage without storing any credentials in code or configuration. Azure automatically manages the identity's lifecycle and provides a token that the VM can use to access the storage account via Azure AD authentication, eliminating the need for secrets.
Variation 2. Three application VMs in different resource groups must use the same Azure identity to read blobs from a storage account. The identity must continue to work if the VMs are redeployed. What should you use?
medium- A.A system-assigned managed identity on each VM
- ✓ B.A user-assigned managed identity
- C.A shared access signature stored in a configuration file
- D.The local Administrator account on each VM
Why B: A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be assigned to multiple VMs across different resource groups. It persists independently of the VM lifecycle, so it continues to work even if the VMs are redeployed, and it can be used to authenticate to Azure Storage for blob read operations via Azure AD.
Variation 3. An App Service application needs to read secrets from Azure Key Vault. The security team does not want any password, certificate, or client secret stored in application settings, and they want the identity removed automatically if the app is deleted. What should the administrator enable?
medium- A.A service principal with a client secret stored in App Service configuration.
- ✓ B.A system-assigned managed identity on the App Service.
- C.A user-assigned managed identity shared by all applications.
- D.A shared access signature stored in Key Vault.
Why B: A system-assigned managed identity (Option B) is the correct choice because it provides an identity for the App Service that is automatically managed by Azure, tied to the lifecycle of the resource (deleted when the app is deleted), and requires no credentials to be stored in application settings. This allows the app to authenticate to Key Vault using Azure AD tokens without any secrets, satisfying the security team's requirements.
Variation 4. Three application VMs in separate resource groups must use the same identity to read a configuration endpoint. The identity must keep working if any one VM is deleted and later recreated. Which three actions should the administrator take? Select three.
medium- ✓ A.Create a user-assigned managed identity that can exist independently of any single VM.
- ✓ B.Attach the same user-assigned managed identity to each of the three VMs.
- ✓ C.Grant the user-assigned identity the minimum required RBAC role on the target configuration endpoint.
- D.Use a system-assigned managed identity on only one VM and copy its access token to the other two VMs.
- E.Store one application password locally on each VM and use it instead of Azure-managed identities.
Why A: A user-assigned managed identity is an Azure resource that exists independently of any VM, unlike a system-assigned identity which is tied to the VM lifecycle. This independence ensures the identity persists even when a VM is deleted and recreated, maintaining continuous access to the configuration endpoint. By creating a user-assigned managed identity, the administrator decouples the identity from any single VM, satisfying the requirement that the identity must keep working after VM deletion and recreation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.