AZ-104 Manage Azure Identities and Governance Practice Question
Three Azure VMs in different resource groups need to access the same Azure resources using one identity. The identity must keep working if any VM is deleted and recreated. What should the administrator assign to the VMs?
⚠ Common exam trap
Watch out — candidates often choose system-assigned managed identities (Option A) because they are simpler to configure, but they fail to recognize that system-assigned identities are deleted with the VM, making them unsuitable for scenarios requiring identity persistence across VM deletions and recreations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A user-assigned managed identity.
A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs, even across different resource groups. If a VM is deleted and recreated, the user-assigned identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure resources without reconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A system-assigned managed identity on each VM.
Why it's wrong here
A system-assigned managed identity is unique to each VM and shares its lifecycle: when the VM is deleted, the identity is automatically removed. To have all three VMs access the same resource, you would need to create three different service principals and assign RBAC permissions to each one individually. This defeats the goal of a shared identity and makes administration brittle if one VM is replaced.
When this WOULD be correct
A system-assigned managed identity would be correct if the question required each VM to have a unique identity for individual resource access, and the VMs are never deleted or recreated, or if the identity is automatically recreated with the new VM.
- ✓
A user-assigned managed identity.
Why this is correct
A user-assigned managed identity exists independently of any VM as an Azure AD identity. Because it is not tied to a VM's lifecycle, the same identity can be assigned to all three VMs in different resource groups, and a single RBAC grant on the target resource applies to every VM that uses it. Azure automatically rotates its credentials, so there is no secret to store or manage.
- ✗
A local administrator account.
Why it's wrong here
A local administrator account is an OS-level account stored in the SAM database of each VM, not an Azure Active Directory identity. It can only authenticate to that VM's operating system and cannot be assigned Azure RBAC permissions to access PaaS resources. Using local accounts for Azure service access would require storing credentials on each machine and provides no centralized governance or auditability.
When this WOULD be correct
An administrator needs to grant administrative access to a single VM for troubleshooting, and the identity must be tied to that VM's lifecycle without requiring Azure AD integration.
- ✗
An Azure Blueprint assignment.
Why it's wrong here
Azure Blueprints is a governance and deployment orchestration service that packages ARM templates, policies, and RBAC assignments into a repeatable definition. It can provision resources and pre-configure access, but a blueprint assignment is not a security principal and has no identity that can authenticate or obtain tokens. It cannot be used by running VMs to call Azure APIs or access services like storage.
When this WOULD be correct
An Azure Blueprint assignment would be correct in a scenario where an organization needs to enforce governance and compliance by deploying a standardized set of Azure resources (e.g., policies, role assignments, resource groups) across multiple subscriptions, ensuring consistent configuration and regulatory adherence.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A user-assigned managed identity.Correct answer▾
Why this is correct
A user-assigned managed identity exists independently of any VM as an Azure AD identity. Because it is not tied to a VM's lifecycle, the same identity can be assigned to all three VMs in different resource groups, and a single RBAC grant on the target resource applies to every VM that uses it. Azure automatically rotates its credentials, so there is no secret to store or manage.
✗A system-assigned managed identity on each VM.Wrong answer — click to see why▾
Why this is wrong here
A system-assigned managed identity is tied to the lifecycle of each VM; if a VM is deleted and recreated, its identity is lost and must be reassigned, failing the requirement that the identity persists across VM deletion and recreation.
★ When this WOULD be the correct answer
A system-assigned managed identity would be correct if the question required each VM to have a unique identity for individual resource access, and the VMs are never deleted or recreated, or if the identity is automatically recreated with the new VM.
Why candidates choose this
Candidates may think system-assigned managed identities are simpler to set up and assume they can be used across multiple VMs, not realizing they are per-resource and not persistent across VM deletion.
✗A local administrator account.Wrong answer — click to see why▾
Why this is wrong here
A local administrator account is tied to a specific VM instance and does not persist if the VM is deleted and recreated. It also cannot provide a single identity for multiple VMs to access Azure resources.
★ When this WOULD be the correct answer
An administrator needs to grant administrative access to a single VM for troubleshooting, and the identity must be tied to that VM's lifecycle without requiring Azure AD integration.
Why candidates choose this
Candidates may confuse local accounts with managed identities, thinking a local admin account can be used for resource access across VMs, or they may overlook the requirement for the identity to survive VM deletion and recreation.
✗An Azure Blueprint assignment.Wrong answer — click to see why▾
Why this is wrong here
An Azure Blueprint assignment is used to define a repeatable set of Azure resources and policies for compliance, not to assign an identity to VMs for accessing resources. It cannot provide a consistent identity that persists across VM deletion and recreation.
★ When this WOULD be the correct answer
An Azure Blueprint assignment would be correct in a scenario where an organization needs to enforce governance and compliance by deploying a standardized set of Azure resources (e.g., policies, role assignments, resource groups) across multiple subscriptions, ensuring consistent configuration and regulatory adherence.
Why candidates choose this
Candidates may confuse Blueprints with identity management because Blueprints can include role assignments, but they are not a mechanism for assigning a managed identity to a VM. The term 'assignment' might misleadingly suggest a direct identity assignment.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
User-assigned managed identity
A user-assigned managed identity is a standalone Azure identity that can be assigned to one or more Azure resources, enabling them to authenticate to other services without storing credentials.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.