Azure Managed Identity: Securely Authenticate Your VM to Azure Resources
An administrator wants to run a one-time Azure CLI command from inside a VM to create a resource in Azure, but the administrator does not want to store credentials on the VM. What should be used for authentication?
Quick Answer
The answer is the VM’s managed identity, because it provides a secure, credential-free way for a virtual machine to authenticate to Azure services. Azure Managed Identity automatically creates a service principal in Azure AD for the VM, and when the administrator runs an Azure CLI command from inside the VM, the CLI can request an access token from the Azure Instance Metadata Service endpoint at 169.254.169.254/metadata/identity/oauth2/token—no passwords, keys, or certificates are ever stored on the VM. On the AZ-104 exam, this scenario tests your understanding of how to eliminate credential management in automated tasks; a common trap is thinking a service principal with a client secret is needed, but that would require storing the secret on the VM, defeating the purpose. Remember the key phrase: “managed identity = no credentials on the box.” For a quick memory tip, think of the endpoint IP as “169.254.169.254” — the last three octets spell “MET” for Metadata Endpoint Token.
⚠ Common exam trap
Test-takers frequently confuse authentication with authorization or network controls, thinking a local password or NSG rule can somehow grant Azure resource creation permissions, when only an Azure AD-backed identity like a managed identity can provide credential-free authentication to ARM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VM's managed identity
Azure Managed Identity provides an automatically managed identity in Azure AD that allows a VM to authenticate to any service that supports Azure AD authentication, including Azure Resource Manager, without storing any credentials on the VM. When the administrator runs the Azure CLI command from within the VM, the CLI can use the managed identity's token endpoint (169.254.169.254/metadata/identity/oauth2/token) to obtain an access token, enabling secure, credential-free resource creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VM's managed identity
Why this is correct
The VM’s managed identity lets scripts or Azure CLI commands authenticate to Azure without storing secrets on the machine. After the identity is enabled and granted the needed role, the command can sign in by using the identity instead of a password or service principal secret. This is the secure and practical approach.
- ✗
A local administrator password
Why it's wrong here
A local administrator password only authenticates to the operating system and does not authorize Azure resource creation. It also requires secret storage and does not meet the requirement to avoid credentials on the VM. It is not an Azure management authentication method.
When this WOULD be correct
When the question asks for authentication to access the VM itself (e.g., RDP or SSH) and the administrator needs to use local credentials because the VM is not joined to a domain.
- ✗
A network security group rule
Why it's wrong here
A network security group rule only controls traffic flow. It does not authenticate Azure CLI sessions or grant rights to create resources. Network access and Azure authorization are separate concerns.
When this WOULD be correct
When the question asks how to allow inbound RDP access to a VM from a specific IP address range, an NSG rule with the appropriate source IP and port 3389 would be the correct answer.
- ✗
An Azure region paired with the VM
Why it's wrong here
A region or paired region affects resource placement and disaster recovery options, not authentication. It does not give a VM permission to create Azure resources and does not replace identity-based access.
When this WOULD be correct
A question asks: 'Which feature ensures data replication across two regions for high availability?' The correct answer would be an Azure region paired with the VM, as it enables geo-redundant storage or paired region failover.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓The VM's managed identityCorrect answer▾
Why this is correct
The VM’s managed identity lets scripts or Azure CLI commands authenticate to Azure without storing secrets on the machine. After the identity is enabled and granted the needed role, the command can sign in by using the identity instead of a password or service principal secret. This is the secure and practical approach.
✗A local administrator passwordWrong answer — click to see why▾
Why this is wrong here
A local administrator password would be stored on the VM, violating the requirement to not store credentials. It also does not provide Azure AD authentication for Azure CLI commands.
★ When this WOULD be the correct answer
When the question asks for authentication to access the VM itself (e.g., RDP or SSH) and the administrator needs to use local credentials because the VM is not joined to a domain.
Why candidates choose this
Candidates may think a local admin password is a simple, familiar authentication method for running commands, overlooking the need for Azure resource access without credential storage.
✗A network security group ruleWrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) rule controls inbound/outbound traffic to a VM, not authentication for Azure CLI commands. It cannot provide credentials or identity for creating Azure resources.
★ When this WOULD be the correct answer
When the question asks how to allow inbound RDP access to a VM from a specific IP address range, an NSG rule with the appropriate source IP and port 3389 would be the correct answer.
Why candidates choose this
Candidates may confuse network security controls with authentication mechanisms, thinking that allowing traffic from the VM to Azure services via an NSG rule is sufficient for authentication.
✗An Azure region paired with the VMWrong answer — click to see why▾
Why this is wrong here
An Azure region paired with the VM is used for disaster recovery and geo-redundancy, not for authentication. It does not provide any identity or credential to authorize Azure CLI commands.
★ When this WOULD be the correct answer
A question asks: 'Which feature ensures data replication across two regions for high availability?' The correct answer would be an Azure region paired with the VM, as it enables geo-redundant storage or paired region failover.
Why candidates choose this
Candidates may confuse regional pairing with authentication because both involve Azure infrastructure, or they might think that being in a paired region grants implicit permissions to create resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which identity should the administrator enable to remove the secret from app settings and have the identity disappear automatically when the app is deleted?
easy- A.User-assigned managed identity
- B.Service principal with a client secret
- ✓ C.System-assigned managed identity
- D.Shared access signature
Why C: The system-assigned managed identity is tied directly to the lifecycle of the Azure resource (e.g., an App Service). When you enable it, Azure automatically creates a service principal in Azure AD for that resource, and you can use the identity to access Azure Key Vault without storing secrets in app settings. When the resource is deleted, the system-assigned managed identity and its corresponding service principal are automatically removed, eliminating the need for manual cleanup.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.