az login --identity for PowerShell Script on Azure VM
A PowerShell script runs on an Azure VM every night and uses Azure CLI commands to create tags and VM resources in another subscription. The script cannot store a password or client secret. What should it use to authenticate to Azure?
Quick Answer
The answer is `az login --identity`. This command is the correct choice because it leverages an Azure VM’s managed identity to authenticate to Azure without storing any password or client secret, using the Azure Instance Metadata Service (IMDS) endpoint to obtain an access token for the target subscription. On the AZ-104 exam, this scenario tests your understanding of managed identities as a secure, secretless authentication method for workloads running on Azure resources like VMs. A common trap is choosing service principals with stored secrets or certificates, but the key constraint here is that the script cannot store any credentials. Remember the memory tip: “No secret? Use the identity.” This directly maps to the requirement for a PowerShell script on an Azure VM to authenticate to another subscription without hardcoded secrets.
⚠ Common exam trap
Candidates often confuse managed identity with service principal secrets or device code authentication, assuming any non-interactive method requires a stored secret, but `az login --identity` provides secretless authentication for Azure resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
az login --identity.
The script runs on an Azure VM and can use a managed identity to authenticate without storing any secrets. The `az login --identity` command uses the VM's system-assigned or user-assigned managed identity to obtain an Azure AD access token via the Azure Instance Metadata Service (IMDS) endpoint. This satisfies the requirement of no password or client secret storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
az login with a username and password.
Why it's wrong here
A username and password requires credential storage and is not appropriate for secretless automation.
When this WOULD be correct
In a scenario where the script runs interactively with a user present, and the user can provide credentials each time without automation constraints, such as a one-time manual task. The question would not prohibit storing credentials or require unattended execution.
- ✓
az login --identity.
Why this is correct
The Azure CLI can sign in with the VM's managed identity by using az login --identity. That allows the script to authenticate without storing a password or client secret. After sign-in, the identity can be granted access to the target subscription or resource group, which makes the solution both secure and automation-friendly for nightly jobs.
- ✗
Connect-AzAccount with device code authentication.
Why it's wrong here
Device code authentication is interactive and not suitable for unattended nightly automation on a VM.
When this WOULD be correct
When an administrator runs a script interactively from their own workstation and wants to authenticate without entering credentials directly in the console, device code authentication is appropriate.
- ✗
An app registration secret stored in a PowerShell variable.
Why it's wrong here
A secret in a variable is still a secret on the machine and violates the stated security requirement.
When this WOULD be correct
If the question allowed storing a secret securely (e.g., in Azure Key Vault) and the script could retrieve it at runtime, then using an app registration secret would be correct. For example: 'A PowerShell script runs on-premises and needs to authenticate to Azure using a service principal with a client secret stored in Azure Key Vault.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓az login --identity.Correct answer▾
Why this is correct
The Azure CLI can sign in with the VM's managed identity by using az login --identity. That allows the script to authenticate without storing a password or client secret. After sign-in, the identity can be granted access to the target subscription or resource group, which makes the solution both secure and automation-friendly for nightly jobs.
✗az login with a username and password.Wrong answer — click to see why▾
Why this is wrong here
The script cannot store a password or client secret, and interactive username/password login is not suitable for unattended execution. Additionally, Azure CLI's 'az login' with username/password requires interactive input or storing credentials, which violates the constraint.
★ When this WOULD be the correct answer
In a scenario where the script runs interactively with a user present, and the user can provide credentials each time without automation constraints, such as a one-time manual task. The question would not prohibit storing credentials or require unattended execution.
Why candidates choose this
Candidates may default to the familiar username/password authentication method without considering the unattended execution requirement or the constraint against storing secrets.
✗Connect-AzAccount with device code authentication.Wrong answer — click to see why▾
Why this is wrong here
Device code authentication requires interactive user input (browser login), but the script runs unattended every night, so it cannot complete the device code flow without human intervention.
★ When this WOULD be the correct answer
When an administrator runs a script interactively from their own workstation and wants to authenticate without entering credentials directly in the console, device code authentication is appropriate.
Why candidates choose this
Candidates may think device code authentication is a secure, non-interactive method because it doesn't require a password in the script, but they overlook that it still requires manual browser interaction.
✗An app registration secret stored in a PowerShell variable.Wrong answer — click to see why▾
Why this is wrong here
The script cannot store a password or client secret, so using an app registration secret stored in a PowerShell variable violates that constraint. Additionally, secrets require secure storage and management, which is not feasible in an unattended script without credential storage.
★ When this WOULD be the correct answer
If the question allowed storing a secret securely (e.g., in Azure Key Vault) and the script could retrieve it at runtime, then using an app registration secret would be correct. For example: 'A PowerShell script runs on-premises and needs to authenticate to Azure using a service principal with a client secret stored in Azure Key Vault.'
Why candidates choose this
Candidates may think that storing a secret in a variable is acceptable because it avoids hardcoding, but they overlook the explicit constraint against storing any password or secret. They also may not realize that managed identity is the simpler, more secure option for Azure VMs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
User-assigned managed identity
A user-assigned managed identity is a standalone Azure identity that can be assigned to one or more Azure resources, enabling them to authenticate to other services without storing credentials.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, a script running on an Azure VM must create resources in another subscription without using passwords or client secrets. Which command should the administrator use first?
easy- ✓ A.az login --identity
- B.az login --service-principal
- C.az account set --subscription <subscriptionId>
- D.Connect-AzAccount -UseDeviceAuthentication
Why A: The script must authenticate without passwords or client secrets, and Azure VMs can use a managed identity for this purpose. The `az login --identity` command authenticates the Azure CLI using the VM's managed identity, which is a passwordless, secretless authentication method. This allows the script to obtain tokens for accessing resources in another subscription, provided the managed identity has appropriate RBAC permissions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.