AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Automation notes VMs: vm-a1, vm-a2, vm-a3 Script requirement: - Authenticate to Azure Resource Manager - No password or certificate stored on disk - Same identity must be used by all three VMs - Identity must survive VM rebuilds and replacements
Based on the exhibit, three Azure virtual machines run the same automation script. The VMs are rebuilt often, and the team wants one identity that can be reused across all three VMs and retained even if a VM is replaced. Which identity type should the administrator use?
⚠ Common exam trap
Watch out — candidates often confuse system-assigned and user-assigned managed identities, assuming that 'system-assigned' means the same identity is automatically shared across all VMs, when in fact each system-assigned identity is unique and tied to a single VM's lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A user-assigned managed identity attached to all three VMs.
A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. Unlike system-assigned identities, which are tied to the lifecycle of a single VM, a user-assigned identity persists independently and remains available even when VMs are rebuilt or replaced. This allows the automation script to use the same identity across all three VMs without needing to reconfigure permissions after each rebuild.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System-assigned managed identity on each VM, because each VM gets the same identity automatically.
Why it's wrong here
System-assigned managed identities are created as a unique, dedicated identity tied to a single Azure resource. Each of the three VMs would therefore receive a different principal ID, so there is no shared 'same identity' — the premise of the option is incorrect. Additionally, a system-assigned identity is deleted together with its VM, so replacing or rebuilding a VM forces you to re-create the identity and update any role assignments, which defeats the scenario's goal of maintaining a persistent identity across all three machines.
When this WOULD be correct
A question where each VM needs its own unique identity that is automatically created and deleted with the VM, and there is no need to share an identity across VMs or retain it after VM deletion.
- ✓
A user-assigned managed identity attached to all three VMs.
Why this is correct
A user-assigned managed identity is independent of any single VM and can be attached to multiple resources. That makes it ideal when several VMs need the same identity and the identity must survive if a VM is deleted, rebuilt, or replaced during maintenance or scaling.
- ✗
An Azure AD guest user account, because the same account can sign in from every VM.
Why it's wrong here
An Azure AD guest user account represents a human user who is invited to the tenant, typically with limited permissions, and uses interactive sign-in with credentials. It is not intended for noninteractive VM workloads: storing the username/password on each VM re-creates the secret-management and credential-rotation burden the scenario explicitly wants to avoid. Furthermore, a guest user is a user principal, not a service principal, so it does not map cleanly to the permission model for Azure resource access from a VM identity.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to allow external users (guests) to access Azure resources, such as granting a partner organization's users access to a specific application or resource group via Azure AD B2B collaboration.
- ✗
A shared storage account key, because it can be used by multiple VMs without extra configuration.
Why it's wrong here
A storage account key is unrelated to Azure Resource Manager authentication and does not meet the requirement for a reusable Azure identity. It would also weaken security because it is a long-lived secret that the team wants to avoid storing on disk.
When this WOULD be correct
In a scenario where multiple VMs need to access the same Azure Storage account (e.g., to read/write blobs) and the team wants to use a single key without managing individual identities, a shared storage account key would be the correct answer. The question would specify that the requirement is for storage access, not for an identity to authenticate to Azure AD-protected resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A user-assigned managed identity attached to all three VMs.Correct answer▾
Why this is correct
A user-assigned managed identity is independent of any single VM and can be attached to multiple resources. That makes it ideal when several VMs need the same identity and the identity must survive if a VM is deleted, rebuilt, or replaced during maintenance or scaling.
✗System-assigned managed identity on each VM, because each VM gets the same identity automatically.Wrong answer — click to see why▾
Why this is wrong here
System-assigned managed identities are tied to the lifecycle of the VM; if the VM is deleted, the identity is also deleted. The requirement is for a single identity that persists even when VMs are replaced, which user-assigned managed identities provide.
★ When this WOULD be the correct answer
A question where each VM needs its own unique identity that is automatically created and deleted with the VM, and there is no need to share an identity across VMs or retain it after VM deletion.
Why candidates choose this
Candidates may think 'system-assigned' means the identity is automatically assigned to each VM and therefore reusable, overlooking that each VM gets a separate identity that is not retained after VM deletion.
✗An Azure AD guest user account, because the same account can sign in from every VM.Wrong answer — click to see why▾
Why this is wrong here
An Azure AD guest user account is for external collaboration, not for providing an identity to Azure resources like VMs. It cannot be assigned to a VM for authentication to Azure services, and it does not support the scenario of being reused across VMs for automation scripts.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to allow external users (guests) to access Azure resources, such as granting a partner organization's users access to a specific application or resource group via Azure AD B2B collaboration.
Why candidates choose this
Candidates may think that a guest user account can be used like a service principal to sign in from multiple VMs, confusing user identities with resource identities, or they may overlook that guest accounts are for human users, not automated processes.
✗A shared storage account key, because it can be used by multiple VMs without extra configuration.Wrong answer — click to see why▾
Why this is wrong here
A shared storage account key provides access to Azure Storage, not an identity for VMs to authenticate to Azure resources. It cannot be used as an identity for VMs to access other Azure services like Key Vault or Azure SQL, and it does not support role-based access control (RBAC) assignments for the VMs themselves.
★ When this WOULD be the correct answer
In a scenario where multiple VMs need to access the same Azure Storage account (e.g., to read/write blobs) and the team wants to use a single key without managing individual identities, a shared storage account key would be the correct answer. The question would specify that the requirement is for storage access, not for an identity to authenticate to Azure AD-protected resources.
Why candidates choose this
Candidates may think a shared key is a simple, reusable credential that can be used by all VMs, similar to how a user-assigned managed identity is shared. They might overlook that a storage account key is not an identity and does not integrate with Azure AD or RBAC for VM-level authentication.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
User-assigned managed identity
A user-assigned managed identity is a standalone Azure identity that can be assigned to one or more Azure resources, enabling them to authenticate to other services without storing credentials.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.