AZ-104 Manage Azure Identities and Governance Practice Question
A VM-hosted automation tool must call Azure APIs without storing a password or certificate on disk. The identity should disappear automatically when the VM is deleted. Which identity should the administrator assign?
⚠ Common exam trap
Candidates often confuse user-assigned and system-assigned managed identities, failing to recognize that only system-assigned identities are automatically deleted with the VM, while user-assigned identities persist independently.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system-assigned managed identity
A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure APIs without storing any credentials (password or certificate) on disk, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A user-assigned managed identity
Why it's wrong here
A user-assigned managed identity does avoid storing any secret on the VM and is a legitimate Azure AD identity, but it is not tied to the VM's lifecycle. When the VM is deleted, the identity persists as a separate resource, so an administrator must manually delete it to avoid leaving an orphaned principal. Because the identity can also be assigned to multiple VMs or other Azure resources, its access cannot be automatically revoked when this specific automation VM is removed, making it a less exact fit than a system-assigned identity for a single VM workload.
When this WOULD be correct
A user-assigned managed identity is correct when multiple Azure resources (e.g., multiple VMs or an App Service) need to share the same identity, or when the identity must be pre-created and assigned to resources across different subscriptions.
- ✗
A service principal with a client secret
Why it's wrong here
A service principal with a client secret requires the secret to be provisioned on the VM, typically in a configuration file, environment variable, or certificate store, which directly violates the requirement to avoid storing credentials. The client secret is a static, high-value secret that is subject to expiry and must be rotated, adding manual lifecycle management and creating a risk of the secret being extracted from disk. In contrast, a managed identity obtains tokens without any secret material persisting in the automation tool, so this service principal pattern is inherently less secure and more operationally complex.
When this WOULD be correct
This option would be correct if the question required an identity that can be used across multiple VMs or resources, or if the automation tool needs to run outside Azure (e.g., on-premises) and must authenticate without relying on Azure infrastructure. It would also be correct if the question explicitly allowed storing secrets in a secure vault like Key Vault.
- ✓
A system-assigned managed identity
Why this is correct
A system-assigned managed identity is tied directly to the VM lifecycle, so it is created with the VM and removed when the VM is deleted. It allows the automation tool to authenticate to Azure services without storing passwords, secrets, or certificates on disk, which is the secure pattern requested.
- ✗
A storage account access key
Why it's wrong here
A storage account access key is not an Azure AD identity; it is a shared secret that grants full data-plane access to all blobs, tables, queues, and files within that specific storage account. The automation tool would have to store this 512-bit key somewhere in the VM, defeating the no-storage requirement, and the key cannot be used to call Azure Resource Manager or any other Azure API. It also cannot be scoped to a single permission, supports no Azure AD conditions or audit identity, and would expose far broader access than the tool actually needs.
When this WOULD be correct
A question asks: 'Which credential should an application use to access a specific storage account when no other authentication method is available?' In that context, a storage account access key would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A system-assigned managed identityCorrect answer▾
Why this is correct
A system-assigned managed identity is tied directly to the VM lifecycle, so it is created with the VM and removed when the VM is deleted. It allows the automation tool to authenticate to Azure services without storing passwords, secrets, or certificates on disk, which is the secure pattern requested.
✗A user-assigned managed identityWrong answer — click to see why▾
Why this is wrong here
A user-assigned managed identity persists independently of the VM lifecycle; it does not disappear automatically when the VM is deleted, failing the requirement for automatic cleanup.
★ When this WOULD be the correct answer
A user-assigned managed identity is correct when multiple Azure resources (e.g., multiple VMs or an App Service) need to share the same identity, or when the identity must be pre-created and assigned to resources across different subscriptions.
Why candidates choose this
Candidates may confuse user-assigned with system-assigned managed identities, assuming both are 'managed' and thus automatically deleted, without realizing that user-assigned identities have a separate lifecycle.
✗A service principal with a client secretWrong answer — click to see why▾
Why this is wrong here
A service principal with a client secret requires storing the secret on disk or in environment variables, which violates the requirement of not storing a password or certificate on disk. Additionally, it does not automatically disappear when the VM is deleted; the service principal persists independently.
★ When this WOULD be the correct answer
This option would be correct if the question required an identity that can be used across multiple VMs or resources, or if the automation tool needs to run outside Azure (e.g., on-premises) and must authenticate without relying on Azure infrastructure. It would also be correct if the question explicitly allowed storing secrets in a secure vault like Key Vault.
Why candidates choose this
Candidates may confuse service principals with managed identities, thinking a service principal is the only way to authenticate to Azure APIs. They might also overlook the 'no password stored on disk' constraint, focusing only on the need for an identity without considering lifecycle management.
✗A storage account access keyWrong answer — click to see why▾
Why this is wrong here
A storage account access key is used for authenticating to Azure Storage, not for calling Azure APIs in general, and it does not provide an identity that disappears when the VM is deleted.
★ When this WOULD be the correct answer
A question asks: 'Which credential should an application use to access a specific storage account when no other authentication method is available?' In that context, a storage account access key would be correct.
Why candidates choose this
Candidates may confuse storage account access keys with managed identities, thinking any key-based authentication can be used for Azure API calls, or they may not understand the scope of access keys.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
System-assigned managed identity
A system-assigned managed identity is an automatically created Azure Active Directory identity that is tied to a specific Azure resource and is used to securely authenticate to other Azure services without storing credentials.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.