Three application VMs in different resource groups must use the same Azure identity to read blobs from a storage account. The identity must continue to work if the VMs are redeployed. What should you use?

A system-assigned managed identity on each VM

Each system-assigned identity is tied to one VM instance, so it is not a shared identity.

A shared access signature stored in a configuration file

A SAS token is a secret credential and is not a durable managed identity for multiple VMs.

The local Administrator account on each VM

Local accounts do not provide a shared Azure identity and would require separate credential management.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A user-assigned managed identity — A user-assigned managed identity is the best choice when multiple Azure resources must share one identity and that identity should outlive the individual VM lifecycle. You can assign the same identity to each VM and grant it the needed role on the storage account. This avoids duplicating secrets and makes redeployment easier because the identity is independent of any one VM instance. Why others are wrong: A system-assigned identity is created per resource, so it cannot be the single shared identity described. A SAS token is a secret, not a managed Azure identity, and storing it in configuration increases operational risk. Local administrator accounts are unrelated to Azure authorization and would not scale cleanly across multiple VMs.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.