AZ-104 Manage Azure Identities and Governance Practice Question
An Azure CLI script runs on a utility VM every night to create and tag resources in another subscription. The script cannot store a password or client secret, and the VM is regularly redeployed from a standard image. What is the best identity design?
⚠ Common exam trap
Many candidates choose system-assigned managed identity (Option A) without realizing that redeploying the VM from a standard image destroys the identity, breaking any cross-subscription role assignments that were configured for the original identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a user-assigned managed identity and attach it to the utility VM
A user-assigned managed identity can be created once, assigned to the utility VM, and used across redeployments without storing any credentials. The script can authenticate via Azure CLI using the managed identity's client ID, and the identity persists independently of the VM's lifecycle, satisfying the requirement of no password or client secret storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a system-assigned managed identity to the utility VM
Why it's wrong here
A system-assigned managed identity is coupled to the VM lifecycle: it is automatically removed when the VM is deleted, and it cannot be reassigned to another resource. Therefore, if the utility VM is ever replaced or recreated, the identity disappears, breaking the nightly script's authentication. It also cannot be shared across resources, making it a poor fit for a reusable automation identity that must remain stable independently of the VM instance.
When this WOULD be correct
A system-assigned managed identity would be correct if the script only needed to manage resources within the same subscription as the VM, and the VM was not regularly redeployed from a standard image (so the identity would persist).
- ✓
Create a user-assigned managed identity and attach it to the utility VM
Why this is correct
A user-assigned managed identity is an independent Azure AD workload identity that you create once and attach to the utility VM. Because it persists separately from the VM, it survives deletion or redeployment of the VM, making it ideal for a nightly Azure CLI script that must continue to authenticate after infrastructure changes. The VM retrieves tokens through the Azure Instance Metadata Service (IMDS) endpoint, so no password or client secret is ever stored on the VM.
- ✗
Create a service principal and store its secret in the VM configuration
Why it's wrong here
Creating a service principal and storing its secret in the VM configuration directly violates the stated requirement to avoid passwords and client credentials on the VM. Even though a service principal could technically authorize Azure CLI commands, the stored secret becomes an exploitable attack surface and requires complex rotation and management. Any configuration file, environment variable, or application setting containing the secret is effectively a credential on the VM, which is exactly what managed identities are designed to prevent.
When this WOULD be correct
If the question allowed storing secrets securely (e.g., using Azure Key Vault with a managed identity to access the secret) and the VM was not redeployed from a standard image, a service principal with a secret stored in Key Vault could be used.
- ✗
Use a shared access signature to sign the Azure CLI session
Why it's wrong here
A shared access signature (SAS) is not an authentication mechanism for the Azure CLI or Azure Resource Manager; it only grants delegated, time-limited permissions to specific Azure Storage resources such as blobs, queues, or tables. Signing an Azure CLI session with a SAS token is conceptually invalid, because the CLI needs an Azure AD token to call ARM for resource deployment operations. SAS cannot authorize creation of VMs, role assignments, or other non-storage resources.
When this WOULD be correct
A question asks for a secure way to grant a client application time-limited access to a specific Azure Storage blob or container without exposing the storage account key. SAS tokens provide granular, revocable access to storage resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a user-assigned managed identity and attach it to the utility VMCorrect answer▾
Why this is correct
A user-assigned managed identity is an independent Azure AD workload identity that you create once and attach to the utility VM. Because it persists separately from the VM, it survives deletion or redeployment of the VM, making it ideal for a nightly Azure CLI script that must continue to authenticate after infrastructure changes. The VM retrieves tokens through the Azure Instance Metadata Service (IMDS) endpoint, so no password or client secret is ever stored on the VM.
✗Assign a system-assigned managed identity to the utility VMWrong answer — click to see why▾
Why this is wrong here
A system-assigned managed identity is tied to the VM's lifecycle and cannot be shared across subscriptions. The script needs to access resources in another subscription, which requires a cross-subscription identity like a user-assigned managed identity.
★ When this WOULD be the correct answer
A system-assigned managed identity would be correct if the script only needed to manage resources within the same subscription as the VM, and the VM was not regularly redeployed from a standard image (so the identity would persist).
Why candidates choose this
Candidates may think system-assigned managed identity is simpler and sufficient, overlooking the cross-subscription requirement and the fact that it is destroyed when the VM is redeployed.
✗Create a service principal and store its secret in the VM configurationWrong answer — click to see why▾
Why this is wrong here
The script cannot store a password or client secret, and the VM is regularly redeployed from a standard image, making secret management impractical and insecure. Option C requires storing a secret, violating the constraint.
★ When this WOULD be the correct answer
If the question allowed storing secrets securely (e.g., using Azure Key Vault with a managed identity to access the secret) and the VM was not redeployed from a standard image, a service principal with a secret stored in Key Vault could be used.
Why candidates choose this
Candidates may default to using a service principal for cross-subscription access without considering the constraints of no secret storage and VM redeployment, overlooking managed identity options.
✗Use a shared access signature to sign the Azure CLI sessionWrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) is used to delegate access to Azure Storage resources, not to authenticate an Azure CLI session or manage identities across subscriptions. It cannot sign CLI sessions or grant permissions to create and tag resources.
★ When this WOULD be the correct answer
A question asks for a secure way to grant a client application time-limited access to a specific Azure Storage blob or container without exposing the storage account key. SAS tokens provide granular, revocable access to storage resources.
Why candidates choose this
Candidates may confuse SAS with a general-purpose authentication mechanism for Azure CLI, or think it can be used to sign scripts, because SAS is a common security feature in Azure.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.