AZ-104 Manage Azure Identities and Governance Practice Question
An operations team needs one Azure identity that can be attached to several VMs and kept even if a VM is deleted. Which two statements about a user-assigned managed identity are correct? Select two.
⚠ Common exam trap
A common mix-up: candidates confuse user-assigned managed identities with system-assigned managed identities, which are tied to the VM lifecycle and are automatically deleted when the VM is deleted, leading them to incorrectly select option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is created as a separate Azure resource.
A user-assigned managed identity is created as a separate Azure resource in its own right, independent of any VM. This means it has its own lifecycle and can be managed (created, deleted, assigned) independently from the VMs it is associated with.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It is created as a separate Azure resource.
Why this is correct
A user-assigned managed identity is provisioned as a standalone Azure resource of type Microsoft.ManagedIdentity/userAssignedIdentities, living in its own resource group with its own object ID. It is created independently of any virtual machine and can be managed, tagged, and role-assigned on its own, before or after a VM uses it. This is what makes it a resource rather than a property of a VM.
- ✓
It can be assigned to more than one VM.
Why this is correct
Because user-assigned identities exist separately, the same identity can be attached to multiple virtual machines at the same time. Each VM's identity block references the shared identity's resource ID, so all those VMs authenticate as the same Azure AD principal and inherit the same RBAC role assignments. This is ideal for giving a fleet of VMs uniform access to a key vault or storage account without creating credential material.
- ✗
It is automatically deleted when the first VM is deleted.
Why it's wrong here
That lifecycle behavior applies to a system-assigned managed identity, which is created with its parent resource and deleted automatically when that resource is removed. A user-assigned identity is a separate resource, so deleting a VM that used it has no effect on the identity; it continues to exist until it is explicitly deleted. Thus, this option incorrectly conflates the two managed identity types.
When this WOULD be correct
For a system-assigned managed identity, which is tied to the VM lifecycle and is automatically deleted when the VM is deleted.
- ✗
It requires a storage account access key to work.
Why it's wrong here
Managed identities do not use storage account access keys or any long-lived secrets. Instead, the identity is represented as an Azure AD service principal, and the VM obtains an access token through the Azure Instance Metadata Service (IMDS) without embedding credentials in code. Storage account access keys are a separate legacy authentication mechanism for the storage data plane and have nothing to do with how a managed identity authenticates.
When this WOULD be correct
In a question about accessing Azure Storage from a VM using a system-assigned managed identity, you might need to configure the storage account firewall to allow access from the VM's subnet, but that does not involve access keys. Alternatively, a question about using storage account access keys directly (not managed identities) would make this correct.
- ✗
It can only be attached to one VM at a time.
Why it's wrong here
This statement incorrectly implies one user-assigned identity is tied to a single VM. In reality, a user-assigned identity is designed explicitly for reuse across many resources concurrently; there is no attachment limit that restricts it to one VM. While a single VM can have multiple user-assigned identities, a single identity is never limited to one VM, so this option is false.
When this WOULD be correct
This option would be correct if the question asked about a system-assigned managed identity, which is tied to a single resource and cannot be shared across multiple VMs.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓It is created as a separate Azure resource.Correct answer▾
Why this is correct
A user-assigned managed identity is provisioned as a standalone Azure resource of type Microsoft.ManagedIdentity/userAssignedIdentities, living in its own resource group with its own object ID. It is created independently of any virtual machine and can be managed, tagged, and role-assigned on its own, before or after a VM uses it. This is what makes it a resource rather than a property of a VM.
✗It is automatically deleted when the first VM is deleted.Wrong answer — click to see why▾
Why this is wrong here
User-assigned managed identities are independent Azure resources; they persist independently of any VM lifecycle and are not automatically deleted when a VM is deleted.
★ When this WOULD be the correct answer
For a system-assigned managed identity, which is tied to the VM lifecycle and is automatically deleted when the VM is deleted.
Why candidates choose this
Candidates may confuse user-assigned with system-assigned managed identities, assuming all managed identities are automatically deleted with the associated VM.
✗It requires a storage account access key to work.Wrong answer — click to see why▾
Why this is wrong here
User-assigned managed identities do not require a storage account access key; they authenticate via Azure AD using a service principal, not storage keys.
★ When this WOULD be the correct answer
In a question about accessing Azure Storage from a VM using a system-assigned managed identity, you might need to configure the storage account firewall to allow access from the VM's subnet, but that does not involve access keys. Alternatively, a question about using storage account access keys directly (not managed identities) would make this correct.
Why candidates choose this
Candidates may confuse managed identities with storage account access keys because both are used for authentication, but managed identities eliminate the need for keys.
✗It can only be attached to one VM at a time.Wrong answer — click to see why▾
Why this is wrong here
User-assigned managed identities are designed to be independent Azure resources that can be assigned to multiple VMs simultaneously; they are not limited to a single VM.
★ When this WOULD be the correct answer
This option would be correct if the question asked about a system-assigned managed identity, which is tied to a single resource and cannot be shared across multiple VMs.
Why candidates choose this
Candidates may confuse user-assigned with system-assigned managed identities, assuming all managed identities are bound to one resource only.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
User-assigned managed identity
A user-assigned managed identity is a standalone Azure identity that can be assigned to one or more Azure resources, enabling them to authenticate to other services without storing credentials.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, three Azure virtual machines run the same automation script. The VMs are rebuilt often, and the team wants one identity that can be reused across all three VMs and retained even if a VM is replaced. Which identity type should the administrator use?
easy- A.System-assigned managed identity on each VM, because each VM gets the same identity automatically.
- ✓ B.A user-assigned managed identity attached to all three VMs.
- C.An Azure AD guest user account, because the same account can sign in from every VM.
- D.A shared storage account key, because it can be used by multiple VMs without extra configuration.
Why B: A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. Unlike system-assigned identities, which are tied to the lifecycle of a single VM, a user-assigned identity persists independently and remains available even when VMs are rebuilt or replaced. This allows the automation script to use the same identity across all three VMs without needing to reconfigure permissions after each rebuild.
Variation 2. Two Azure virtual machines run the same automation script and both need access to Key Vault and Storage. The script must keep working if one VM is redeployed, and the team wants the same identity to be usable by both VMs. What should the administrator use?
medium- A.A system-assigned managed identity on each VM
- ✓ B.A user-assigned managed identity attached to both VMs
- C.A service principal stored in a configuration file on the VMs
- D.A storage account access key stored in the script
Why B: A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. This ensures both VMs share the same identity for accessing Key Vault and Storage, and the identity persists independently of any single VM's lifecycle, so redeploying one VM does not break access for the other.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.