The answer is to assign a managed identity to the container group and grant it the AcrPull role on the Azure Container Registry. This works because Azure Container Groups support Azure AD authentication via managed identities, allowing the container runtime to pull private images without ever storing credentials in the configuration. When a system-assigned or user-assigned identity is enabled on the container group, it can authenticate directly to ACR using that identity, provided the identity has been granted the AcrPull role at the registry scope. On the AZ-104 exam, this scenario tests your understanding of how to securely access private container images without using admin keys or SAS tokens—a common trap is assuming you must store credentials in the container definition. Remember the key pairing: Managed Identity + AcrPull role = no stored credentials. A helpful mnemonic is “MIA Pulls”: Managed Identity Authenticates to Pull.
AZ-104 Deploy and Manage Azure Compute Practice Question
This AZ-104 practice question tests your understanding of deploy and manage azure compute. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: managed identities provide an Azure AD identity for Azure resources.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Template excerpt:
```
resources:
- type: Microsoft.ContainerInstance/containerGroups
name: cg-transform
properties:
containers:
- name: transform
properties:
image: contoso.azurecr.io/transform:3.0
imageRegistryCredentials: []
```
Requirement: the image is stored in Azure Container Registry and no username, password, or connection string may be embedded in the deployment
Based on the exhibit, what should the administrator configure so the container group can pull the private image without storing registry credentials?
Template excerpt:
```
resources:
- type: Microsoft.ContainerInstance/containerGroups
name: cg-transform
properties:
containers:
- name: transform
properties:
image: contoso.azurecr.io/transform:3.0
imageRegistryCredentials: []
```
Requirement: the image is stored in Azure Container Registry and no username, password, or connection string may be embedded in the deployment
A
Assign a managed identity to the container group and grant it AcrPull on the registry.
Managed identity-based access is the correct secret-free method for Azure Container Instances to authenticate to Azure Container Registry. By assigning an identity to the container group and granting that identity the AcrPull role on the registry, the group can pull the private image without storing credentials in the template. This satisfies both security and operational requirements.
B
Store the ACR admin account password in a container environment variable.
Why wrong: Embedding a password in configuration violates the requirement to avoid stored credentials.
C
Use a SAS token for the container image reference.
Why wrong: SAS tokens are not the normal authentication method for pulling private container images from ACR.
D
Place the registry in the same resource group as the container group.
Why wrong: Resource group placement does not authorize access to a private registry.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a managed identity to the container group and grant it AcrPull on the registry.
Option A is correct because Azure Container Groups support managed identities, which allow the container group to authenticate to Azure Container Registry (ACR) without storing any credentials. By assigning a system-assigned or user-assigned managed identity to the container group and granting it the AcrPull role on the registry, the container runtime can use Azure AD authentication to pull the private image. This eliminates the need to store registry admin credentials or SAS tokens in the container configuration.
Key principle: Managed identities provide an Azure AD identity for Azure resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Assign a managed identity to the container group and grant it AcrPull on the registry.
Why this is correct
Managed identity-based access is the correct secret-free method for Azure Container Instances to authenticate to Azure Container Registry. By assigning an identity to the container group and granting that identity the AcrPull role on the registry, the group can pull the private image without storing credentials in the template. This satisfies both security and operational requirements.
Related concept
Managed identities provide an Azure AD identity for Azure resources.
✗
Store the ACR admin account password in a container environment variable.
Why it's wrong here
Embedding a password in configuration violates the requirement to avoid stored credentials.
✗
Use a SAS token for the container image reference.
Why it's wrong here
SAS tokens are not the normal authentication method for pulling private container images from ACR.
✗
Place the registry in the same resource group as the container group.
Why it's wrong here
Resource group placement does not authorize access to a private registry.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse SAS tokens (used for Azure Storage) with ACR authentication, or assume that resource group placement or admin credentials are valid solutions, when the core requirement is to use Azure AD-based authentication via a managed identity to avoid storing any credentials.
Detailed technical explanation
How to think about this question
Under the hood, when a managed identity is assigned to a container group, Azure automatically provisions a service principal in Azure AD and injects an access token into the container's environment via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254. The container runtime (e.g., containerd) uses this token to authenticate to ACR via the OAuth2 token exchange flow, which is defined in RFC 6749. In a real-world scenario, this approach is critical for production workloads where rotating admin keys or storing secrets in environment variables is impractical and insecure.
KKey Concepts to Remember
Managed identities provide an Azure AD identity for Azure resources.
They eliminate the need to store credentials in code or configuration.
The 'AcrPull' role grants read-only access to pull images from Azure Container Registry.
Azure Container Instances can use managed identities to authenticate to ACR.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Managed identities provide an Azure AD identity for Azure resources.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-104 question in full detail.
Review managed identities provide an Azure AD identity for Azure resources., then practise related AZ-104 questions on the same topic to reinforce the concept.
Deploy and Manage Azure Compute — This question tests Deploy and Manage Azure Compute — Managed identities provide an Azure AD identity for Azure resources..
What is the correct answer to this question?
The correct answer is: Assign a managed identity to the container group and grant it AcrPull on the registry. — Option A is correct because Azure Container Groups support managed identities, which allow the container group to authenticate to Azure Container Registry (ACR) without storing any credentials. By assigning a system-assigned or user-assigned managed identity to the container group and granting it the AcrPull role on the registry, the container runtime can use Azure AD authentication to pull the private image. This eliminates the need to store registry admin credentials or SAS tokens in the container configuration.
What should I do if I get this AZ-104 question wrong?
Review managed identities provide an Azure AD identity for Azure resources., then practise related AZ-104 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Managed identities provide an Azure AD identity for Azure resources.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.