User-Assigned Managed Identity for Multiple VMs
Exhibit
Deployment note: - vm-app1 is in rg-web - vm-app2 is in rg-api - vm-app3 is in rg-batch - All three VMs must read from the same storage account - The identity must keep working if one VM is reimaged or replaced - Access should be granted once and then reused by all three VMs
Based on the exhibit, which identity approach should be used so all three virtual machines can reuse the same Azure access without sharing secrets?
Quick Answer
The answer is to use a user-assigned managed identity and attach it to all three VMs. This is correct because a user-assigned managed identity is a standalone Azure resource that can be shared across multiple virtual machines, allowing them to reuse the same Azure access without sharing secrets. Instead of embedding credentials, each VM obtains tokens from Azure AD via the Instance Metadata Service (IMDS) endpoint, so no secrets are ever stored or rotated. On the AZ-104 exam, this scenario tests your understanding of identity management versus system-assigned identities, which are tied to a single resource and cannot be reused. A common trap is to choose a service principal or system-assigned identity, but those either require secret management or lack multi-VM support. Memory tip: think “user-assigned = reusable across VMs, system-assigned = one per VM.”
⚠ Common exam trap
Candidates often confuse system-assigned and user-assigned managed identities, incorrectly assuming that system-assigned identities can be shared across multiple VMs, when in fact only user-assigned identities support multi-VM assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a user-assigned managed identity and attach it to all three VMs.
A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure VMs, allowing all three VMs to authenticate to Azure services (e.g., Azure Storage, Key Vault) using the same identity without sharing any secrets. This approach eliminates the need to manage or rotate credentials, as the identity is managed entirely by Azure AD and tokens are obtained via the Azure Instance Metadata Service (IMDS) endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a system-assigned managed identity to each VM.
Why it's wrong here
A system-assigned identity is bound to one VM, so it cannot be shared cleanly across multiple machines.
When this WOULD be correct
A question asks: 'You need to grant each VM access to Azure Key Vault without managing credentials, and each VM requires a unique identity for auditing purposes.' In that case, assigning a system-assigned managed identity to each VM would be correct.
- ✓
Use a user-assigned managed identity and attach it to all three VMs.
Why this is correct
A user-assigned managed identity is the right fit when multiple resources need the same Azure identity. It is created as a standalone resource and can be attached to all three VMs, so the access model remains consistent even if a VM is reimaged or replaced. This also avoids storing storage keys, passwords, or connection strings in the application or operating system.
- ✗
Create a storage account access key and place it in each VM's application settings.
Why it's wrong here
Sharing storage keys increases risk and does not satisfy the requirement to avoid secrets.
When this WOULD be correct
This option would be correct if the question asked for a simple, low-cost method to grant all three VMs access to a storage account without requiring Azure AD integration or managed identities, and the VMs are in a trusted environment where key rotation is acceptable.
- ✗
Create a separate SAS token for each VM and rotate it manually.
Why it's wrong here
SAS tokens are limited-time secrets and do not provide the shared, identity-based access pattern requested.
When this WOULD be correct
If the question required granting time-limited, granular access to a specific storage container for each VM individually, and the VMs needed different permissions or expiration times, separate SAS tokens would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use a user-assigned managed identity and attach it to all three VMs.Correct answer▾
Why this is correct
A user-assigned managed identity is the right fit when multiple resources need the same Azure identity. It is created as a standalone resource and can be attached to all three VMs, so the access model remains consistent even if a VM is reimaged or replaced. This also avoids storing storage keys, passwords, or connection strings in the application or operating system.
✗Assign a system-assigned managed identity to each VM.Wrong answer — click to see why▾
Why this is wrong here
System-assigned managed identities are tied to a single VM and cannot be shared across multiple VMs. The question requires a single identity reused by all three VMs, which user-assigned managed identities support.
★ When this WOULD be the correct answer
A question asks: 'You need to grant each VM access to Azure Key Vault without managing credentials, and each VM requires a unique identity for auditing purposes.' In that case, assigning a system-assigned managed identity to each VM would be correct.
Why candidates choose this
Candidates may confuse system-assigned and user-assigned managed identities, assuming both can be shared, or they may think 'system-assigned' is the default and simpler choice without considering the sharing requirement.
✗Create a storage account access key and place it in each VM's application settings.Wrong answer — click to see why▾
Why this is wrong here
Storage account access keys provide full control over the storage account and must be shared or stored in each VM's application settings, violating the requirement to avoid sharing secrets. They also do not support granular, identity-based access for individual VMs.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a simple, low-cost method to grant all three VMs access to a storage account without requiring Azure AD integration or managed identities, and the VMs are in a trusted environment where key rotation is acceptable.
Why candidates choose this
Candidates may think access keys are a straightforward way to grant access without understanding that they are shared secrets, not identity-based, and that they lack fine-grained control and automatic rotation compared to managed identities.
✗Create a separate SAS token for each VM and rotate it manually.Wrong answer — click to see why▾
Why this is wrong here
SAS tokens must be stored and rotated manually, which violates the requirement to 'reuse the same Azure access without sharing secrets.' They are per-resource tokens that cannot be shared across VMs without exposing secrets.
★ When this WOULD be the correct answer
If the question required granting time-limited, granular access to a specific storage container for each VM individually, and the VMs needed different permissions or expiration times, separate SAS tokens would be appropriate.
Why candidates choose this
Candidates may confuse SAS tokens with managed identities, thinking that generating a token per VM is a secure way to grant access without realizing that SAS tokens are secrets that must be managed and rotated, and they don't allow reuse across VMs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
User-assigned managed identity
A user-assigned managed identity is a standalone Azure identity that can be assigned to one or more Azure resources, enabling them to authenticate to other services without storing credentials.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A system-assigned managed identity is attached to an Azure VM to call Key Vault. The VM is frequently reimaged and sometimes redeployed to a different name during scale events, but the application must keep the same identity and secretless access. What should the administrator use instead?
hard- A.A system-assigned managed identity on each newly deployed VM.
- ✓ B.A user-assigned managed identity associated with the workload.
- C.A shared storage account key placed in the VM custom script.
- D.A policy exemption for the Key Vault access policy.
Why B: A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently when VMs are reimaged or redeployed with different names. This allows the application to retain the same identity and secretless access to Key Vault without requiring manual reconfiguration or credential rotation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.