AZ-104 Manage Azure Identities and Governance Practice Question
Several Azure VMs need the same Azure identity so they can access a shared resource without storing passwords. The identity should be reusable across VMs and removable centrally. Which identity type should the administrator use?
⚠ Common exam trap
Many candidates choose system-assigned managed identity because it is simpler to configure, but they overlook the requirement for the identity to be reusable across multiple VMs, which only user-assigned managed identities support.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User-assigned managed identity
A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource, can be assigned to multiple VMs simultaneously, and can be centrally removed or updated without affecting the VMs themselves. This identity is reusable across VMs and eliminates the need to store passwords or secrets in code or configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System-assigned managed identity
Why it's wrong here
A system-assigned managed identity is created implicitly for each VM, and its entire lifecycle — creation, deletion, and principal ID — is tied to that single resource. The moment the VM is deleted, its identity is also deleted, and you cannot assign a system-assigned identity from one VM to another. Because each VM would receive a distinct object ID, system-assigned identities cannot give several VMs the same Azure identity.
When this WOULD be correct
If the question required an identity that is automatically created and tied to a single Azure resource (e.g., a VM that needs to access a resource without manual credential management), system-assigned managed identity would be correct.
- ✓
User-assigned managed identity
Why this is correct
A user-assigned managed identity is a standalone Azure AD identity created as its own Azure resource, and it can be attached to multiple VMs at once. Because the identity's lifecycle is independent of any single VM, the same principal and its role assignments can be used across a fleet, and Azure automatically rotates the underlying certificates used for token acquisition. This gives the VMs a consistent, secret-less identity for authenticating to Azure services such as Key Vault or Storage.
- ✗
Service principal with a client secret
Why it's wrong here
A service principal with a client secret is technically able to be stored on multiple VMs and used to acquire Azure AD tokens, so it could work. However, that approach requires you to embed a secret on each VM, which exposes the credential to theft, requires scheduled rotation, and typically needs application registration and consent. A user-assigned managed identity is preferred because it removes the secret-handling burden while still offering a shared, controllable identity across VMs.
When this WOULD be correct
When an application running outside Azure (e.g., on-premises or another cloud) needs to authenticate to Azure resources, and the identity must be managed independently of any specific VM lifecycle.
- ✗
Local administrator account
Why it's wrong here
A local administrator account exists only in the VM's local SAM database, not in Azure AD, so it cannot authenticate against Azure Resource Manager or other Azure AD-backed services. Using the same local password across several VMs is a password-management risk, with no built-in rotation and no way to apply Azure role-based access control to that account. It is therefore not an Azure identity at all and cannot satisfy the requirement for shared Azure identity.
When this WOULD be correct
If the question specified a single VM needing local administrative access without Azure AD integration, or if the scenario involved on-premises VMs not connected to Azure, a local administrator account would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓User-assigned managed identityCorrect answer▾
Why this is correct
A user-assigned managed identity is a standalone Azure AD identity created as its own Azure resource, and it can be attached to multiple VMs at once. Because the identity's lifecycle is independent of any single VM, the same principal and its role assignments can be used across a fleet, and Azure automatically rotates the underlying certificates used for token acquisition. This gives the VMs a consistent, secret-less identity for authenticating to Azure services such as Key Vault or Storage.
✗System-assigned managed identityWrong answer — click to see why▾
Why this is wrong here
A system-assigned managed identity is tied to a single VM and cannot be reused across multiple VMs; it is created and deleted with the VM, not centrally removable.
★ When this WOULD be the correct answer
If the question required an identity that is automatically created and tied to a single Azure resource (e.g., a VM that needs to access a resource without manual credential management), system-assigned managed identity would be correct.
Why candidates choose this
Candidates may confuse 'system-assigned' with 'user-assigned' or assume that any managed identity can be shared, overlooking the per-resource binding of system-assigned identities.
✗Service principal with a client secretWrong answer — click to see why▾
Why this is wrong here
A service principal with a client secret requires storing and managing a secret, which contradicts the requirement to avoid storing passwords. It is also not reusable across VMs in a centralized, removable way like a managed identity.
★ When this WOULD be the correct answer
When an application running outside Azure (e.g., on-premises or another cloud) needs to authenticate to Azure resources, and the identity must be managed independently of any specific VM lifecycle.
Why candidates choose this
Candidates may confuse service principals with managed identities, thinking a service principal is the only way to grant Azure AD-based access, or they may overlook the 'no password storage' constraint.
✗Local administrator accountWrong answer — click to see why▾
Why this is wrong here
A local administrator account is tied to a single VM, cannot be reused across multiple VMs, and requires password management, which contradicts the requirement for a centrally removable identity without storing passwords.
★ When this WOULD be the correct answer
If the question specified a single VM needing local administrative access without Azure AD integration, or if the scenario involved on-premises VMs not connected to Azure, a local administrator account would be appropriate.
Why candidates choose this
Candidates may think a local admin account is a simple, familiar identity solution for VMs, overlooking the need for cross-VM reusability and central management.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.