Several Azure VMs need the same Azure identity so they can access a shared resource without storing passwords. The identity should be reusable across VMs and removable centrally. Which identity type should the administrator use?

System-assigned managed identity

System-assigned identities are tied to one resource and are not shared across multiple VMs.

Service principal with a client secret

A service principal can work, but secrets increase administrative overhead and rotation risk.

Local administrator account

A local account stays on the VM and is not the secure Azure identity pattern here.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: User-assigned managed identity — A user-assigned managed identity is the correct answer because it is created as a standalone Azure resource and can be attached to multiple VMs. That makes it ideal when several machines need the same identity and the organization wants central lifecycle management. It also avoids storing passwords or secrets in configuration files. If the VMs are replaced, the identity can remain in place and be reattached as needed. Why others are wrong: A system-assigned managed identity is bound to a single VM, so it is not the best option when the same identity must be reused across multiple VMs. A service principal with a client secret works, but it introduces secret storage and rotation concerns. A local administrator account is not an Azure identity and does not provide secure shared access to Azure resources. The question asks for a reusable Azure identity, which is a user-assigned managed identity.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.