AZ-104 Manage Azure Identities and Governance Practice Question
A web app running on an Azure VM must read files from Azure Blob Storage without storing any passwords, secrets, or access keys on the VM. The identity should be tied to that VM and removed automatically if the VM is deleted. What should you enable?
⚠ Common exam trap
Test-takers frequently confuse service endpoints (which only provide network-level access control) with managed identities (which provide identity-based authentication), leading them to select option D thinking it enables secure access without credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system-assigned managed identity
A system-assigned managed identity is the correct choice because it creates an identity in Azure AD that is tied directly to the lifecycle of the VM. When the VM is deleted, the identity is automatically removed. The VM can use this identity to authenticate to Azure Blob Storage via Azure AD without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) to obtain tokens.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A system-assigned managed identity
Why this is correct
A system-assigned managed identity is created for one Azure resource, such as a VM, and its lifecycle is tied to that resource. The app can use Azure AD-based authentication to access Blob Storage without storing secrets on the VM. If the VM is deleted, the identity is also removed, which matches the requirement exactly. This is the preferred approach for credential-free access when only one VM needs the identity.
- ✗
A shared storage account key in the application settings
Why it's wrong here
Placing a storage account key in application settings merely moves the secret into a configuration store; it does not eliminate the need to manage, rotate, and protect that key. The storage account key grants full access to all services within the storage account (blobs, tables, queues, and files), violating least privilege, and it cannot be scoped to a single application workload. If the key leaks, an attacker gains broad access, and auditing only records key-based usage, not a specific VM or app identity. This directly contradicts the no-secret, identity-based access the question demands.
When this WOULD be correct
In a scenario where an application needs to access Blob Storage with full account-level access and the security policy allows storing keys in a secure configuration store (e.g., Azure Key Vault) or the application is not tied to a specific VM identity, a shared key might be used.
- ✗
A user account with a local password on the VM
Why it's wrong here
A local user account with a password on the VM is only for signing in to the operating system session, not for authenticating to Azure services. It exists in the local SAM database and has no representation in Azure AD or any RBAC role that could authorize blob storage access. To use it for blob reads you would have to store credentials in the app and use them somehow, which still leaves the secret-management problem unsolved. Additionally, local accounts cannot be granted data-plane roles on Azure resources, so they are entirely unrelated to secure storage authorization.
When this WOULD be correct
If the question required interactive login to the VM for administrative tasks (e.g., RDP or SSH) and did not mention avoiding stored credentials, enabling a local user account with a password would be appropriate.
- ✗
A service endpoint on the VM subnet
Why it's wrong here
A service endpoint on the VM subnet only controls network traffic by restricting connectivity from the subnet to the storage account over the Azure backbone. It does not provide any identity or authentication mechanism; the application still needs an Azure AD token, a shared key, or a SAS to authorize each request. Even with a service endpoint, the storage account has 'Allow trusted Microsoft services' enabled at most, which does not grant the VM's workload identity any specific data-plane permission. Therefore, it cannot satisfy a credential-free access requirement.
When this WOULD be correct
When the question asks for a method to restrict access to Azure Storage from only a specific virtual network subnet, without requiring identity-based authentication, enabling a service endpoint on that subnet would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A system-assigned managed identityCorrect answer▾
Why this is correct
A system-assigned managed identity is created for one Azure resource, such as a VM, and its lifecycle is tied to that resource. The app can use Azure AD-based authentication to access Blob Storage without storing secrets on the VM. If the VM is deleted, the identity is also removed, which matches the requirement exactly. This is the preferred approach for credential-free access when only one VM needs the identity.
✗A shared storage account key in the application settingsWrong answer — click to see why▾
Why this is wrong here
A shared storage account key is a static secret that must be stored on the VM, violating the requirement to avoid storing passwords or keys. It also persists beyond the VM's lifecycle, so it is not automatically removed when the VM is deleted.
★ When this WOULD be the correct answer
In a scenario where an application needs to access Blob Storage with full account-level access and the security policy allows storing keys in a secure configuration store (e.g., Azure Key Vault) or the application is not tied to a specific VM identity, a shared key might be used.
Why candidates choose this
Candidates may think using a storage account key is a straightforward way to grant access, overlooking the requirement to avoid storing secrets on the VM and the need for automatic identity removal.
✗A user account with a local password on the VMWrong answer — click to see why▾
Why this is wrong here
A user account with a local password on the VM would require storing credentials on the VM, which violates the requirement to avoid storing passwords or secrets. Additionally, it is not automatically removed when the VM is deleted.
★ When this WOULD be the correct answer
If the question required interactive login to the VM for administrative tasks (e.g., RDP or SSH) and did not mention avoiding stored credentials, enabling a local user account with a password would be appropriate.
Why candidates choose this
Candidates may think that a user account can be used to authenticate to Azure Blob Storage via some mechanism, or they may confuse identity management with local user accounts.
✗A service endpoint on the VM subnetWrong answer — click to see why▾
Why this is wrong here
A service endpoint on the VM subnet secures traffic to Azure Storage but does not provide identity-based access; it still requires a shared key or SAS token for authentication, which violates the requirement to avoid storing secrets on the VM.
★ When this WOULD be the correct answer
When the question asks for a method to restrict access to Azure Storage from only a specific virtual network subnet, without requiring identity-based authentication, enabling a service endpoint on that subnet would be correct.
Why candidates choose this
Candidates may confuse service endpoints with managed identities, thinking that securing the network path eliminates the need for credentials, but service endpoints do not grant access permissions—they only enforce network-level restrictions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Blob
A blob is a large piece of unstructured data, like a photo or video, stored in the cloud with a unique identifier.
Key term
Blob storage
Blob storage is a cloud service for storing large amounts of unstructured data, such as text or binary data, like documents, images, and videos.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.