AZ-204 Develop Azure compute solutions Practice Question
Which TWO actions should you take to enable a user-assigned managed identity for an Azure App Service web app?
⚠ Common exam trap
Candidates often confuse user-assigned managed identities with system-assigned managed identities, assuming the identity must be created in the same resource group as the web app or that its client ID must be manually stored in an app setting, when in fact user-assigned identities are independent resources that can be created anywhere and are automatically discoverable by the consuming service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create the managed identity resource in Microsoft Entra ID.
A user-assigned managed identity is a standalone Azure resource created in Microsoft Entra ID (formerly Azure AD). It must exist as an identity resource before it can be assigned to any Azure service, including an App Service web app. This identity is then tied to a specific tenant and can be used by multiple Azure resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create the managed identity resource in Microsoft Entra ID.
Why this is correct
Creating a user-assigned managed identity involves provisioning it as a standalone Azure resource, distinct from the consuming service. This resource is then registered with Microsoft Entra ID, establishing its unique identity principal. This initial creation step is fundamental, as it defines the identity that will subsequently be assigned to Azure services like web apps, making it a prerequisite for their use.
- ✗
Configure the identity in each deployment slot separately.
Why it's wrong here
Configuring the identity in each deployment slot separately is incorrect because user-assigned managed identities are assigned at the parent Azure resource level, such as an App Service. All deployment slots associated with that App Service automatically inherit the same managed identity. This design simplifies management and ensures consistent identity-based access control across different deployment environments without per-slot configuration.
- ✗
Store the identity's client ID in an app setting.
Why it's wrong here
Storing the identity's client ID in an app setting is unnecessary and defeats a primary security benefit of managed identities. Azure automatically injects the identity's credentials, including the client ID, into the environment of the assigned resource via the Azure Instance Metadata Service (IMDS). Applications can retrieve these details dynamically, eliminating the need to hardcode or store sensitive information in configuration.
- ✗
Create the managed identity in the same resource group as the web app.
Why it's wrong here
Creating the managed identity in the same resource group as the web app is not a technical requirement for its functionality. User-assigned managed identities are global resources within an Azure subscription and can be assigned to any compatible Azure resource, regardless of their respective resource groups. While co-location might be chosen for organizational or management purposes, it is not a prerequisite for the identity to function correctly.
- ✓
Assign the identity to the web app in the Azure portal or CLI.
Why this is correct
Assigning the identity to the web app in the Azure portal or CLI is the critical step that links the pre-created user-assigned managed identity to the specific Azure resource. This action grants the web app the ability to authenticate to other Azure services using the identity's credentials. Without this explicit assignment, the web app would not be able to leverage the managed identity for secure, secret-less access to resources like Azure Key Vault or Storage.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.