AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Application requirement: - A web API runs on a single Azure VM - The API must read blobs from Azure Storage without any stored password, key, or connection string - The identity must be tied to the VM and removed automatically when the VM is deleted
Based on the exhibit, which identity should be enabled on the VM so the application can access Azure Blob Storage and the identity disappears when the VM is deleted?
⚠ Common exam trap
A common mix-up: candidates confuse user-assigned managed identities (which persist independently) with system-assigned managed identities (which are tied to the VM lifecycle), leading them to select the wrong option when the question explicitly requires the identity to disappear with the VM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
System-assigned managed identity
A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It can be granted access to Azure Blob Storage via Azure RBAC, allowing the application to authenticate without storing credentials. This matches the requirement for an identity that disappears with the VM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
System-assigned managed identity
Why this is correct
A system-assigned managed identity is tied directly to one Azure resource, such as a VM. It is created and removed with the VM, which matches the requirement that the identity disappear automatically when the VM is deleted. The application can use the identity to request tokens for Blob Storage without storing secrets in code or configuration.
- ✗
User-assigned managed identity
Why it's wrong here
A user-assigned managed identity is an independent Azure resource that is created, managed, and deleted separately from any VM. While it avoids secrets, it does not disappear automatically when the VM is deleted—the identity remains available for other resources to use. This violates the explicit requirement that the identity vanishes with the VM, making it the wrong choice despite its other benefits.
When this WOULD be correct
A user-assigned managed identity would be correct if the question required the same identity to be used across multiple VMs or resources, and the identity must remain available after a VM is deleted for other resources to use.
- ✗
Storage account shared key
Why it's wrong here
A storage account shared key is a long-lived, static credential that grants broad access to the entire storage account. Using it requires storing the key in code, configuration, or a secret store, which directly contradicts the 'no secrets' requirement. Moreover, the key is not tied to the VM lifecycle; deleting the VM does not delete or invalidate the key, so it would persist beyond the VM's existence.
When this WOULD be correct
This option would be correct in a scenario where an application needs to access Azure Blob Storage using a key-based authentication method, and the question does not require the access credential to disappear when the VM is deleted, or where the key is managed separately.
- ✗
SAS token stored in a startup script
Why it's wrong here
A SAS token embedded in a startup script is still a secret. It must be stored somewhere, rotated periodically, and protected against exposure; if the script is accessed, the token leaks. Additionally, the token is not automatically destroyed when the VM is deleted—it remains embedded in the script or any copied artifacts, violating the requirement that the identity disappear with the VM.
When this WOULD be correct
A question that asks for a method to grant temporary, scoped access to a specific blob or container from a VM, where the access must be revocable independently of the VM lifecycle, and the solution must not require identity management in Azure AD.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓System-assigned managed identityCorrect answer▾
Why this is correct
A system-assigned managed identity is tied directly to one Azure resource, such as a VM. It is created and removed with the VM, which matches the requirement that the identity disappear automatically when the VM is deleted. The application can use the identity to request tokens for Blob Storage without storing secrets in code or configuration.
✗User-assigned managed identityWrong answer — click to see why▾
Why this is wrong here
User-assigned managed identity persists independently of the VM lifecycle; it does not disappear when the VM is deleted, failing the requirement that the identity disappears with the VM.
★ When this WOULD be the correct answer
A user-assigned managed identity would be correct if the question required the same identity to be used across multiple VMs or resources, and the identity must remain available after a VM is deleted for other resources to use.
Why candidates choose this
Candidates may confuse user-assigned and system-assigned managed identities, thinking both are tied to the VM lifecycle, or they may recall that user-assigned identities are more flexible and assume they are the default choice for any scenario.
✗Storage account shared keyWrong answer — click to see why▾
Why this is wrong here
A storage account shared key provides full access to the storage account and does not disappear when the VM is deleted; it persists until manually rotated or deleted, and it is not an identity tied to the VM lifecycle.
★ When this WOULD be the correct answer
This option would be correct in a scenario where an application needs to access Azure Blob Storage using a key-based authentication method, and the question does not require the access credential to disappear when the VM is deleted, or where the key is managed separately.
Why candidates choose this
Candidates may think a shared key is a simple way to grant access without understanding managed identities, or they may confuse shared keys with identity-based access, overlooking the requirement for the credential to be tied to the VM lifecycle.
✗SAS token stored in a startup scriptWrong answer — click to see why▾
Why this is wrong here
SAS tokens stored in a startup script do not automatically disappear when the VM is deleted; they persist in the script or storage, and they require manual management, unlike managed identities which are tied to the VM lifecycle.
★ When this WOULD be the correct answer
A question that asks for a method to grant temporary, scoped access to a specific blob or container from a VM, where the access must be revocable independently of the VM lifecycle, and the solution must not require identity management in Azure AD.
Why candidates choose this
Candidates may think a SAS token is a simple way to grant access without understanding that it does not automatically delete with the VM and requires secure storage, leading them to overlook the lifecycle requirement.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Blob
A blob is a large piece of unstructured data, like a photo or video, stored in the cloud with a unique identifier.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.