AZ-204 Practice Question: User-assigned managed identity shared across…
Twenty Azure Functions across different teams all need read access to the same Azure Cosmos DB account. The security team wants to revoke or modify this access for all twenty functions at once without visiting each Function App individually. What managed identity design satisfies this requirement?
⚠ Common exam trap
Many exam-takers confuse system-assigned managed identities (which are tied to a single resource) with user-assigned managed identities (which can be shared across resources), leading them to choose Option B because they think 'managed identity' automatically means system-assigned, missing the central management requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create one user-assigned managed identity, attach it to all twenty Function Apps, and grant it the Cosmos DB Built-in Data Reader role
A single user-assigned managed identity can be created once and then attached to all twenty Function Apps. Granting that identity the Cosmos DB Built-in Data Reader role at the Cosmos DB account scope means that revoking or modifying the role assignment centrally affects all functions simultaneously, without needing to visit each app individually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create one user-assigned managed identity, attach it to all twenty Function Apps, and grant it the Cosmos DB Built-in Data Reader role
Why this is correct
The role assignment on the user-assigned identity propagates instantly to all twenty Function Apps that reference it. Revoking the role assignment revokes access everywhere simultaneously. Adding a new Function App just requires attaching the existing identity — no new role grants are needed.
- ✗
Enable a system-assigned managed identity on each Function App and grant each identity the Cosmos DB Built-in Data Reader role
Why it's wrong here
Enabling a system-assigned managed identity on each of the twenty Function Apps would result in twenty distinct identities, each with its own lifecycle tied to its respective app. Consequently, granting access to Cosmos DB would necessitate creating twenty individual role assignments, one for each unique identity. This approach introduces significant operational overhead for management, as revoking or modifying access would require twenty separate administrative actions, directly contradicting the goal of streamlined security management.
- ✗
Create a service principal, store its client secret in Key Vault, and reference the secret from all twenty Function Apps via Key Vault references
Why it's wrong here
This approach reintroduces a shared secret that must be rotated, stored securely, and distributed. Managed identities eliminate the need for any shared secrets. The user-assigned managed identity is the zero-secret equivalent of a shared service principal.
- ✗
Store the Cosmos DB connection string in Azure App Configuration and reference it from all twenty Function Apps
Why it's wrong here
A shared connection string in App Configuration grants access to whoever holds the string. Revoking access requires rotating the connection string and updating App Configuration — which requires all twenty apps to reload. It also reintroduces the credential storage problem that managed identities solve.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Azure Functions Bindings
Azure Functions Bindings are declarative connections that link your serverless function code to Azure services or external resources, handling input and output data automatically without writing extra networking or authentication code.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.