Using Managed Identity to Upload Blobs Without Keys or SAS
A Windows VM in Azure must upload log files to a blob container every hour. Security policy forbids storing the storage account key or any long-lived SAS token on the VM. Which two actions should the administrator take? Select two.
Quick Answer
The answer is to enable a system-assigned managed identity on the VM and assign it the Storage Blob Data Contributor role on the storage account or container. This works because the managed identity provides the VM with an Azure AD identity, allowing it to authenticate directly to Azure without ever storing a key or SAS token on the disk. The Storage Blob Data Contributor role grants the identity the necessary permissions to upload blobs, satisfying the security policy that forbids long-lived credentials. On the AZ-104 exam, this scenario tests your understanding of managed identity for blob storage upload as a secure, credential-free alternative to access keys—a common trap is choosing a SAS token or key vault reference, which still involves storing or rotating secrets. Remember the mnemonic: “Managed ID, no key to hide—just assign the role and let Azure decide.”
⚠ Common exam trap
It's easy for candidates to confuse the Reader role (which only grants control plane read access) with data plane roles like Storage Blob Data Contributor, or mistakenly think a non-expiring SAS is acceptable despite the explicit security policy forbidding long-lived credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a system-assigned managed identity on the VM.
A system-assigned managed identity on the VM allows it to authenticate to Azure AD without storing any credentials. By assigning the Storage Blob Data Contributor role to that identity on the storage account or container, the VM can upload logs using Azure AD authentication, which satisfies the security policy forbidding storage account keys or long-lived SAS tokens.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable a system-assigned managed identity on the VM.
Why this is correct
A system-assigned managed identity gives the VM an Azure identity without storing secrets on the server. It can authenticate to Azure Storage through Microsoft Entra ID.
- ✓
Assign the Storage Blob Data Contributor role to that identity on the storage account or container.
Why this is correct
This role grants the data-plane permissions needed to upload blobs. Assigning it at the storage account or container scope follows least privilege while still allowing writes.
- ✗
Copy the storage account access key into a configuration file on the VM.
Why it's wrong here
An access key is a long-lived secret and violates the requirement not to store credentials on the VM. It also creates unnecessary exposure if the VM is compromised.
When this WOULD be correct
If the security policy allowed storing keys and the requirement was to use the storage account key for authentication (e.g., legacy applications that cannot use managed identities), then copying the key to a configuration file would be correct.
- ✗
Assign the Reader role at the resource group scope to the VM identity.
Why it's wrong here
Reader only permits viewing Azure resources in the management plane. It does not allow the VM to upload blob data to the storage account.
When this WOULD be correct
If the question required the VM to only read configuration files or monitor resource properties without writing data, assigning the Reader role at the resource group scope would be correct to allow read-only access to all resources in that group.
- ✗
Create a shared access signature that never expires and place it on the VM.
Why it's wrong here
A never-expiring SAS token is effectively a stored secret and does not meet the security requirement. SAS should be time-limited and tightly scoped.
When this WOULD be correct
If the question allowed using a SAS token with a limited expiry (e.g., 1 hour) and the VM could renew it via a secure mechanism (e.g., Azure Key Vault), then creating and using such a token would be correct. The token must have an expiry and not be stored permanently on the VM.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a system-assigned managed identity on the VM.Correct answer▾
Why this is correct
A system-assigned managed identity gives the VM an Azure identity without storing secrets on the server. It can authenticate to Azure Storage through Microsoft Entra ID.
✗Copy the storage account access key into a configuration file on the VM.Wrong answer — click to see why▾
Why this is wrong here
Copying the storage account access key into a configuration file violates the security policy forbidding storage of keys on the VM, and it exposes the key to potential compromise.
★ When this WOULD be the correct answer
If the security policy allowed storing keys and the requirement was to use the storage account key for authentication (e.g., legacy applications that cannot use managed identities), then copying the key to a configuration file would be correct.
Why candidates choose this
Candidates may think that using the storage account key is a straightforward way to authenticate, overlooking the security policy and the availability of more secure managed identity options.
✗Assign the Reader role at the resource group scope to the VM identity.Wrong answer — click to see why▾
Why this is wrong here
The Reader role only allows read access to Azure resources but does not grant permissions to write data to a blob container. The VM needs to upload logs, which requires write permissions, so the Storage Blob Data Contributor role is necessary.
★ When this WOULD be the correct answer
If the question required the VM to only read configuration files or monitor resource properties without writing data, assigning the Reader role at the resource group scope would be correct to allow read-only access to all resources in that group.
Why candidates choose this
Candidates may confuse the Reader role with a general permission that enables data access, or they might think that any role assignment to a managed identity is sufficient for authentication, overlooking the specific data actions needed.
✗Create a shared access signature that never expires and place it on the VM.Wrong answer — click to see why▾
Why this is wrong here
A SAS token that never expires violates the security policy forbidding long-lived tokens, and storing it on the VM contradicts the requirement to avoid storing credentials on the VM.
★ When this WOULD be the correct answer
If the question allowed using a SAS token with a limited expiry (e.g., 1 hour) and the VM could renew it via a secure mechanism (e.g., Azure Key Vault), then creating and using such a token would be correct. The token must have an expiry and not be stored permanently on the VM.
Why candidates choose this
Candidates may think a non-expiring SAS token is a convenient way to grant access without using account keys, overlooking the security policy against long-lived tokens and the requirement to avoid storing credentials on the VM.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Blob
A blob is a large piece of unstructured data, like a photo or video, stored in the cloud with a unique identifier.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web app running in Azure App Service must upload files to a blob container. The team wants to avoid storing any secrets in application settings and wants the app to authenticate without a password or access key. What should the administrator configure?
medium- A.Store the storage account key in the app configuration and use it from the application
- ✓ B.Enable a system-assigned managed identity for the app and grant it a storage data role
- C.Create an anonymous public container so the app can upload without authentication
- D.Use a shared access signature generated from the storage account root key
Why B: A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. By granting the identity the 'Storage Blob Data Contributor' role via Azure RBAC, the app can upload files using Azure AD authentication, eliminating the need for passwords or access keys.
Variation 2. A web app running in Azure App Service must upload images to a blob container without storing any account keys, passwords, or connection strings in configuration. The app uses only one Azure resource. What should the administrator configure?
medium- ✓ A.A system-assigned managed identity on the App Service and an Azure RBAC role on the storage account.
- B.The storage account key, because it is the simplest way to authenticate an application securely.
- C.A shared access signature embedded in the app settings, because SAS is the same as managed identity.
- D.An anonymous public container with write access disabled on the account.
Why A: A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any credentials in configuration. By assigning the RBAC role (e.g., Storage Blob Data Contributor) to that identity, the app can securely upload images using Azure AD authentication, meeting the requirement of no account keys, passwords, or connection strings.
Variation 3. A Python app running on an Azure VM must upload blobs to one container in a storage account. The app must not store a storage account key or SAS token on the VM. Which two actions should the administrator take? Select two.
easy- ✓ A.Enable a system-assigned managed identity on the VM.
- ✓ B.Assign the Storage Blob Data Contributor role to that managed identity at the container scope.
- C.Store the storage account access key in an environment variable on the VM.
- D.Generate a service SAS and copy it into the application configuration.
- E.Assign the Contributor role on the resource group to the managed identity.
Why A: A system-assigned managed identity on the VM allows Azure AD authentication without storing any credentials on the VM. By assigning the Storage Blob Data Contributor role to that identity at the container scope, the app can use Azure AD tokens to authenticate and upload blobs, eliminating the need for a storage account key or SAS token.
Variation 4. A team runs a Windows VM in Azure that uploads invoices to a blob container. Security policy forbids storing storage account keys or long-lived SAS tokens on the VM. The app must keep working until the VM is deleted, and access should disappear automatically when the VM is removed. What should the administrator configure?
medium- ✓ A.Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.
- B.Create an account SAS token with write permissions and store it in a secure file on the VM.
- C.Assign the Reader role on the storage account to the VM's computer account.
- D.Enable shared key access and rotate the storage account keys regularly.
Why A: Assigning the VM's managed identity the Storage Blob Data Contributor role on the storage account or container allows the VM to authenticate to Azure Blob Storage without storing any keys or tokens. Managed identities provide an automatically managed service principal in Azure AD, and the application can use the Azure Instance Metadata Service (IMDS) to obtain an access token. When the VM is deleted, the managed identity is automatically removed, and the role assignment becomes invalid, so access disappears immediately.
Variation 5. A web app running in Azure App Service must read blobs from a storage account. The app must authenticate without storing secrets or SAS tokens, and administrators should grant only blob data permissions, not storage management permissions. What should you configure?
medium- A.The storage account access key in an application setting, because it works with any blob operation.
- ✓ B.A system-assigned managed identity for the app with Storage Blob Data Reader assigned at the storage scope.
- C.The Contributor role on the storage account, because it includes both management and data permissions.
- D.A service endpoint on the subnet, because service endpoints are used for application authentication.
Why B: A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets or SAS tokens. By assigning the Storage Blob Data Reader role at the storage account scope, you grant only the necessary blob read permissions while explicitly excluding any storage management permissions (e.g., creating or deleting storage accounts). This aligns with the principle of least privilege and eliminates credential management overhead.
Variation 6. A web API running in an Azure App Service needs to read and write blobs in a storage account. The operations team does not want to store secrets in app settings or rotate credentials manually. What should they enable on the App Service?
medium- A.A storage account access key stored in Key Vault
- ✓ B.A system-assigned managed identity
- C.A shared access signature embedded in the application settings
- D.A service endpoint on the App Service integration subnet
Why B: A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. The identity is automatically managed by Azure AD, and the App Service can use it to obtain an OAuth 2.0 token for accessing blob storage via RBAC. This eliminates the need for manual credential rotation and secret storage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.