System-Assigned vs User-Assigned Managed Identity Lifecycle
A developer wants to give one Azure VM access to Azure Storage now, and that identity should be removed automatically if the VM is deleted. Which identity type should the administrator assign?
Quick Answer
The answer is a system-assigned managed identity because its lifecycle is directly tied to the Azure resource it’s enabled on, such as a VM. When the VM is deleted, Azure automatically removes the system-assigned identity from Azure AD and cleans up all associated role assignments, meeting the developer’s requirement for zero-touch cleanup. On the AZ-104 exam, this distinction between system-assigned and user-assigned managed identity lifecycle is a frequent trap: many candidates mistakenly choose user-assigned, which persists independently even after the VM is deleted, requiring manual deletion. The exam tests your understanding that system-assigned identities are resource-scoped and ephemeral, while user-assigned identities are standalone Azure resources with their own lifecycle. A simple memory tip: think “system = same lifecycle as the resource,” so if the resource goes, the identity goes with it.
⚠ Common exam trap
Many candidates confuse user-assigned managed identities with system-assigned ones, assuming both are automatically deleted, but only system-assigned identities are lifecycle-coupled to the resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system-assigned managed identity
A system-assigned managed identity is tied directly to the lifecycle of the Azure VM. When the VM is deleted, Azure automatically removes the identity from Azure AD and revokes any associated role assignments, fulfilling the developer's requirement for automatic cleanup. This identity is created and managed by Azure without any additional administrative overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A user-assigned managed identity
Why it's wrong here
A user-assigned managed identity can be shared across multiple resources and remains independent of any single VM. That makes it useful for reuse, but it does not automatically disappear when one VM is deleted. This does not match the requirement for VM-tied lifecycle behavior.
When this WOULD be correct
A user-assigned managed identity is correct when multiple Azure resources (e.g., several VMs or an App Service) need to share the same identity, or when the identity must be pre-created and assigned to a resource after creation, independent of the resource's lifecycle.
- ✓
A system-assigned managed identity
Why this is correct
A system-assigned managed identity is attached directly to one Azure resource, such as a VM, and Azure manages its lifecycle with that resource. If the VM is deleted, the identity is also removed automatically. This makes it the right choice when the identity should exist only for that VM.
- ✗
A storage account SAS token
Why it's wrong here
A SAS token is a signed access string for storage, not an Azure identity. It can expire, but it does not provide a managed identity lifecycle tied to the VM. It would also have to be stored or distributed somewhere, which is not the desired model here.
When this WOULD be correct
A question asking for a method to grant temporary, delegated access to a specific storage account resource (e.g., a blob or container) without requiring Azure AD authentication, where the access should be revocable by regenerating the token or waiting for its expiry.
- ✗
An NSG service tag
Why it's wrong here
A service tag is used in network security rules to represent groups of IP addresses. It does not grant the VM access to Azure Storage through identity-based authentication and does not have a lifecycle tied to the VM. It is the wrong feature for this requirement.
When this WOULD be correct
An NSG service tag would be correct in a question about restricting network traffic from a VM to Azure Storage without using public IPs, such as: 'Which feature should you use to allow outbound traffic from a VM to Azure Storage without specifying IP ranges?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A system-assigned managed identityCorrect answer▾
Why this is correct
A system-assigned managed identity is attached directly to one Azure resource, such as a VM, and Azure manages its lifecycle with that resource. If the VM is deleted, the identity is also removed automatically. This makes it the right choice when the identity should exist only for that VM.
✗A user-assigned managed identityWrong answer — click to see why▾
Why this is wrong here
A user-assigned managed identity persists independently of the VM lifecycle; it is not automatically deleted when the VM is deleted, failing the requirement for automatic removal.
★ When this WOULD be the correct answer
A user-assigned managed identity is correct when multiple Azure resources (e.g., several VMs or an App Service) need to share the same identity, or when the identity must be pre-created and assigned to a resource after creation, independent of the resource's lifecycle.
Why candidates choose this
Candidates may confuse user-assigned with system-assigned, thinking both are 'managed identities' and not realizing the key difference in lifecycle dependency on the resource.
✗A storage account SAS tokenWrong answer — click to see why▾
Why this is wrong here
A storage account SAS token provides time-limited access but is not tied to the VM's lifecycle; it does not automatically revoke access when the VM is deleted.
★ When this WOULD be the correct answer
A question asking for a method to grant temporary, delegated access to a specific storage account resource (e.g., a blob or container) without requiring Azure AD authentication, where the access should be revocable by regenerating the token or waiting for its expiry.
Why candidates choose this
Candidates may confuse SAS tokens with managed identities because both can grant access to Azure Storage without storing credentials in code, but SAS tokens lack automatic lifecycle management tied to the VM.
✗An NSG service tagWrong answer — click to see why▾
Why this is wrong here
NSG service tags are used to define network access rules based on Azure services, not to provide identity for VM access to storage. They do not support automatic removal upon VM deletion.
★ When this WOULD be the correct answer
An NSG service tag would be correct in a question about restricting network traffic from a VM to Azure Storage without using public IPs, such as: 'Which feature should you use to allow outbound traffic from a VM to Azure Storage without specifying IP ranges?'
Why candidates choose this
Candidates may confuse network-level access control (NSG service tags) with identity-based access, thinking a service tag can grant permissions to a VM to access storage.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Several Azure VMs need the same Azure identity so they can access a shared resource without storing passwords. The identity should be reusable across VMs and removable centrally. Which identity type should the administrator use?
easy- A.System-assigned managed identity
- ✓ B.User-assigned managed identity
- C.Service principal with a client secret
- D.Local administrator account
Why B: A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource, can be assigned to multiple VMs simultaneously, and can be centrally removed or updated without affecting the VMs themselves. This identity is reusable across VMs and eliminates the need to store passwords or secrets in code or configuration.
Variation 2. A web API runs on a single Azure VM and must access Azure Key Vault without storing any credentials on the VM. The identity should be tied to that VM and removed when the VM is deleted. What should you enable?
medium- A.A user-assigned managed identity
- ✓ B.A system-assigned managed identity
- C.A storage account shared access signature
- D.A local administrator account with a strong password
Why B: A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — it is created when the VM is provisioned and automatically deleted when the VM is deleted. This identity can be used to authenticate to Azure Key Vault without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) endpoint to obtain tokens. This matches the requirement that the identity be removed when the VM is deleted.
Variation 3. Three Azure VMs run the same scheduled script and must access both Storage and Key Vault. The team wants one identity that can be reused if a VM is rebuilt, and they do not want the identity tied to a single machine. What should the administrator create?
medium- A.A system-assigned managed identity on each virtual machine.
- B.A service principal with a certificate file copied to each VM.
- ✓ C.A user-assigned managed identity attached to all three virtual machines.
- D.A shared access signature for each storage account and Key Vault access policy.
Why C: A user-assigned managed identity is the correct choice because it is an independent Azure resource that can be assigned to multiple VMs, persists independently of any single VM's lifecycle, and can be reused when a VM is rebuilt. This identity provides seamless authentication to both Storage and Key Vault without managing credentials, meeting the requirement for a reusable, non-machine-tied identity.
Variation 4. Three Azure VMs in different resource groups need to access the same Azure resources using one identity. The identity must keep working if any VM is deleted and recreated. What should the administrator assign to the VMs?
medium- A.A system-assigned managed identity on each VM.
- ✓ B.A user-assigned managed identity.
- C.A local administrator account.
- D.An Azure Blueprint assignment.
Why B: A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs, even across different resource groups. If a VM is deleted and recreated, the user-assigned identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure resources without reconfiguration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.