AZ-104 Manage Azure Identities and Governance Practice Question
A VM-hosted automation tool must call Azure Resource Manager APIs, but the team will not store a password, certificate, or client secret on the VM. The identity should also disappear automatically when the VM is deleted. Which identity should be assigned?
⚠ Common exam trap
A common mix-up: candidates confuse user-assigned managed identities with system-assigned ones, failing to recognize that user-assigned identities are independent resources that do not automatically disappear when the VM is deleted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
System-assigned managed identity
A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Azure VM—when the VM is deleted, the identity is automatically removed. It allows the automation tool to authenticate to Azure Resource Manager APIs without storing any credentials (password, certificate, or client secret) on the VM, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
System-assigned managed identity
Why this is correct
A system-assigned managed identity is the correct choice because it is directly tied to the VM's lifecycle and has no credential management. The identity is automatically provisioned in Azure AD and can be granted Azure Resource Manager RBAC permissions, such as Contributor or Reader, without storing any secrets. When the VM is deleted, the identity is automatically removed, meeting the requirement to avoid leftover or orphaned credentials. The automation tool merely needs to request a token from the Azure Instance Metadata Service (IMDS) using the default identity.
- ✗
User-assigned managed identity
Why it's wrong here
A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple VMs, so it does not disappear when any single VM is deleted. While it can authenticate to Azure Resource Manager without secrets, its lifecycle is independent, meaning the identity remains in Azure AD until explicitly deleted. This makes it less suitable for a dedicated VM hosting an automation tool where the identity is expected to be tied to that VM's lifecycle. The requirement implicitly favors a system-assigned identity, which is automatically removed with the VM, eliminating orphaned identities.
When this WOULD be correct
A user-assigned managed identity is correct when multiple Azure resources (e.g., multiple VMs) need to share the same identity, or when the identity must be pre-created and assigned to a resource after creation, such as in a scenario where the identity lifecycle is managed independently from the resource.
- ✗
Service principal with a client secret
Why it's wrong here
A service principal with a client secret requires you to create, store, rotate, and protect the secret, which directly contradicts the requirement to avoid credential management. Even if the secret is embedded in the VM's configuration, it introduces operational overhead and security risks, such as secret leakage or expiration. Additionally, a service principal is usually an app registration that exists independently of the VM, so it persists even after the VM is decommissioned, leaving a dangling principal that must be manually cleaned up.
When this WOULD be correct
When an application needs to authenticate to Azure AD with a client secret that can be rotated independently of the VM lifecycle, and the team is willing to manage secret storage securely (e.g., using Azure Key Vault).
- ✗
Shared access signature
Why it's wrong here
A shared access signature (SAS) is a security token used to delegate limited access to Azure Storage resources, such as blobs, queues, tables, or files. It is not a valid authentication mechanism for the Azure Resource Manager control plane; ARM expects an OAuth 2.0 bearer token from Azure AD, not a storage-specific SAS. Even if the automation tool only needs to interact with storage, it would not fulfill the core requirement of calling Azure Resource Manager APIs for resource management operations.
When this WOULD be correct
A question where a VM or application needs to access a specific Azure Storage container or blob with time-limited, granular permissions (e.g., read-only for 1 hour) without using a full identity. The correct answer would be a SAS token.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓System-assigned managed identityCorrect answer▾
Why this is correct
A system-assigned managed identity is the correct choice because it is directly tied to the VM's lifecycle and has no credential management. The identity is automatically provisioned in Azure AD and can be granted Azure Resource Manager RBAC permissions, such as Contributor or Reader, without storing any secrets. When the VM is deleted, the identity is automatically removed, meeting the requirement to avoid leftover or orphaned credentials. The automation tool merely needs to request a token from the Azure Instance Metadata Service (IMDS) using the default identity.
✗User-assigned managed identityWrong answer — click to see why▾
Why this is wrong here
User-assigned managed identity does not automatically disappear when the VM is deleted; it must be manually deleted separately, failing the requirement for automatic cleanup.
★ When this WOULD be the correct answer
A user-assigned managed identity is correct when multiple Azure resources (e.g., multiple VMs) need to share the same identity, or when the identity must be pre-created and assigned to a resource after creation, such as in a scenario where the identity lifecycle is managed independently from the resource.
Why candidates choose this
Candidates may confuse user-assigned with system-assigned managed identities, thinking both are 'managed' and thus automatically deleted, or they may recall that user-assigned identities can be reused across resources without realizing they persist after resource deletion.
✗Service principal with a client secretWrong answer — click to see why▾
Why this is wrong here
A service principal with a client secret requires storing a secret on the VM, which violates the constraint of not storing credentials. Additionally, it does not automatically disappear when the VM is deleted.
★ When this WOULD be the correct answer
When an application needs to authenticate to Azure AD with a client secret that can be rotated independently of the VM lifecycle, and the team is willing to manage secret storage securely (e.g., using Azure Key Vault).
Why candidates choose this
Candidates may think a service principal is necessary for API access and overlook the managed identity option, or they may not fully understand that managed identities eliminate the need for secret management.
✗Shared access signatureWrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) is used to grant delegated access to Azure Storage resources, not to authenticate to Azure Resource Manager APIs. It cannot serve as an identity for a VM to call ARM APIs.
★ When this WOULD be the correct answer
A question where a VM or application needs to access a specific Azure Storage container or blob with time-limited, granular permissions (e.g., read-only for 1 hour) without using a full identity. The correct answer would be a SAS token.
Why candidates choose this
Candidates may confuse SAS with a general authentication mechanism for Azure APIs, or think it can be used like a token for any Azure service, not just Storage.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
System-assigned managed identity
A system-assigned managed identity is an automatically created Azure Active Directory identity that is tied to a specific Azure resource and is used to securely authenticate to other Azure services without storing credentials.
Key term
Azure Resource Manager
Azure Resource Manager (ARM) is the deployment and management service for Azure that provides a consistent management layer for creating, updating, and deleting resources in your Azure account.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.