Service Principal: Authenticate On-Premises Build Server to Azure Without Passwords
Exhibit
Build server details: - Host: ONPREM-BUILD01 - Location: On-premises datacenter - Current command: az login with a user name and password - Requirement: Noninteractive Azure authentication for deployment jobs - Constraint: The server is not running in Azure.
Based on the exhibit, which identity type should be used so the on-premises build server can authenticate to Azure without using a human account password?
Quick Answer
The answer is a service principal, because it provides a non-human identity that allows an on-premises build server to authenticate to Azure without using a human account password. Service principals authenticate via OAuth 2.0 client credentials grant flow using a client secret or certificate, enabling secure, password-less automation for build pipelines. On the AZ-104 exam, this scenario tests your understanding of Azure AD application registrations and managed identities—a common trap is confusing a service principal with a managed identity, but remember that managed identities are tied to Azure resources, while service principals are ideal for external, on-premises systems. The exam often presents this as a choice between a user account, a managed identity, and a service principal; the key differentiator is that the build server is on-premises, so a service principal with a certificate is the only password-less option. Memory tip: think “SP for SP”—Service Principal for Server Pipeline.
⚠ Common exam trap
Candidates often confuse managed identities (which are Azure-resource-bound) with service principals (which are application identities), leading them to choose a managed identity option even though the on-premises server cannot host an Azure-managed identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service principal
A service principal is the correct identity type for an on-premises build server to authenticate to Azure without a human account password because it represents a non-human identity that can be assigned to applications, services, and automation tools. Service principals authenticate using client secrets or certificates, enabling secure, password-less authentication via OAuth 2.0 client credentials grant flow, which is ideal for automated build pipelines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System-assigned managed identity
Why it's wrong here
System-assigned managed identities only work for supported Azure resources, not for an on-premises server.
When this WOULD be correct
When the question asks for an identity type for an Azure resource (e.g., an Azure VM or App Service) to authenticate to Azure services without managing credentials, system-assigned managed identity is the correct choice.
- ✗
User-assigned managed identity
Why it's wrong here
User-assigned managed identities also require an Azure resource to attach to, so they do not fit an on-premises build server.
When this WOULD be correct
If the build server were an Azure VM or an Azure resource (e.g., Azure DevOps agent running on an Azure VM), a user-assigned managed identity would be correct. The question would specify that the resource is hosted in Azure and needs to authenticate without storing credentials.
- ✓
Service principal
Why this is correct
A service principal is the correct choice for non-Azure automation that needs to authenticate to Azure without using a person’s credentials. It can be paired with a certificate or secret and used by build and deployment tools running outside Azure.
- ✗
Azure Storage access key
Why it's wrong here
A storage access key is only for storage account access and does not provide Azure Resource Manager authentication.
When this WOULD be correct
A question asking 'Which method should be used to securely access Azure Blob Storage from an application without using a user account?' would make D correct, as access keys provide shared key authentication for storage accounts.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Service principalCorrect answer▾
Why this is correct
A service principal is the correct choice for non-Azure automation that needs to authenticate to Azure without using a person’s credentials. It can be paired with a certificate or secret and used by build and deployment tools running outside Azure.
✗System-assigned managed identityWrong answer — click to see why▾
Why this is wrong here
System-assigned managed identity is tied to a specific Azure resource (e.g., a VM) and cannot be used by an on-premises build server, which is outside Azure.
★ When this WOULD be the correct answer
When the question asks for an identity type for an Azure resource (e.g., an Azure VM or App Service) to authenticate to Azure services without managing credentials, system-assigned managed identity is the correct choice.
Why candidates choose this
Candidates may confuse managed identities (designed for Azure resources) with service principals (used for external applications), assuming both provide passwordless authentication without considering the location constraint.
✗User-assigned managed identityWrong answer — click to see why▾
Why this is wrong here
User-assigned managed identities are tied to Azure resources (e.g., VMs, App Services) and cannot be used by an on-premises build server, which is outside Azure. The question requires an identity that works for an on-premises resource, so a service principal (app registration) is needed.
★ When this WOULD be the correct answer
If the build server were an Azure VM or an Azure resource (e.g., Azure DevOps agent running on an Azure VM), a user-assigned managed identity would be correct. The question would specify that the resource is hosted in Azure and needs to authenticate without storing credentials.
Why candidates choose this
Candidates may confuse managed identities as a universal solution for passwordless authentication, not realizing they are limited to Azure resources. The term 'managed identity' sounds like it should work anywhere, but it requires an Azure resource context.
✗Azure Storage access keyWrong answer — click to see why▾
Why this is wrong here
Azure Storage access keys are used to authenticate to Azure Storage services, not to authenticate an on-premises build server to Azure in general. They do not support authentication without a human account password in the context of Azure AD authentication.
★ When this WOULD be the correct answer
A question asking 'Which method should be used to securely access Azure Blob Storage from an application without using a user account?' would make D correct, as access keys provide shared key authentication for storage accounts.
Why candidates choose this
Candidates may confuse access keys with a form of non-human authentication, thinking they can be used to authenticate any Azure resource, but they are specific to storage and not suitable for general Azure AD authentication.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A build server hosted in a company datacenter must deploy ARM templates to a target resource group in Azure without storing a user password. The server is not running in Azure, and the team wants to authorize deployments with Azure RBAC. What should be configured?
medium- ✓ A.A service principal authenticated with a certificate and assigned RBAC on the target scope
- B.A system-assigned managed identity on the build server
- C.A personal user account with multifactor authentication
- D.A shared access signature for the resource group
Why A: A service principal authenticated with a certificate is the correct approach because it allows non-Azure resources (like an on-premises build server) to authenticate to Azure without storing a user password. The certificate-based authentication satisfies the requirement to avoid storing a password, and assigning RBAC on the target resource group grants the service principal the necessary permissions to deploy ARM templates. This method is secure, supports automation, and aligns with Azure AD application registration best practices.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.