Two Azure virtual machines run the same automation script and both need access to Key Vault and Storage. The script must keep working if one VM is redeployed, and the team wants the same identity to be usable by both VMs. What should the administrator use?

A system-assigned managed identity on each VM

This identity is tied to a single resource and cannot be shared across multiple VMs.

A service principal stored in a configuration file on the VMs

This introduces secret handling on the hosts and is less secure than a managed identity.

A storage account access key stored in the script

This only helps with storage and does not provide a secure identity for Key Vault access.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: A user-assigned managed identity attached to both VMs — A user-assigned managed identity is the best fit when multiple Azure resources must share the same identity and permissions. It is created as a standalone resource and can be attached to both VMs, which means the script can authenticate without storing credentials on either machine. Because the identity is independent of the VM lifecycle, it continues to work if one VM is reimaged, redeployed, or replaced. That makes it more resilient than a system-assigned identity. Why others are wrong: A system-assigned managed identity is bound to one VM, so it cannot be reused across both servers. A service principal stored in a file creates credential management risk and requires secret rotation. A storage account key is not a general-purpose identity and would not solve Key Vault authentication. The user-assigned managed identity is the only option that meets the sharing and lifecycle requirements cleanly.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.