AZ-120 · Question #278
Drag and Drop Question You have an Azure subscription that is linked to an Azure AD tenant. The subscription contains a virtual machine named VM1. You install SAP Landscape Management (LaMa) on VM1…
The correct answer is From the Azure portal, create an app registration.; From the Azure portal, create a system-assigned managed identity for VM1.; From the Azure portal, assign the Contributor role to the managed identity for the subscription. SAP LaMa + Azure: Drag-and-Drop Explanation Context SAP LaMa needs to authenticate with Azure to provision and manage VMs. This requires an Azure identity, proper permissions, and then the connector configuration. The "minimize administrative effort" hint points toward managed…
Question
Drag and Drop Question You have an Azure subscription that is linked to an Azure AD tenant. The subscription contains a virtual machine named VM1. You install SAP Landscape Management (LaMa) on VM1. You need to ensure that you can use SAP LaMa to manage the deployment of SAP workloads to Azure virtual machines. The solution must minimize administrative effort. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:
Exhibit
Answer Area
Drag items
Correct arrangement
- From the Azure portal, create an app registration.
- From the Azure portal, create a system-assigned managed identity for VM1.
- From the Azure portal, assign the Contributor role to the managed identity for the subscription.
Explanation
SAP LaMa + Azure: Drag-and-Drop Explanation
Context
SAP LaMa needs to authenticate with Azure to provision and manage VMs. This requires an Azure identity, proper permissions, and then the connector configuration. The "minimize administrative effort" hint points toward managed identity over manual credential management.
Why This Order
Step 1 - Create an app registration
An app registration creates a service principal in Azure AD, which is the identity SAP LaMa's Azure connector uses to authenticate against the Azure Resource Manager API. This must come first because it establishes the foundational Azure AD identity that the connector depends on. Without it, SAP LaMa has no way to prove its identity to Azure.
Step 2 - Create a system-assigned managed identity for VM1
After registering the app, you enable a system-assigned managed identity on VM1 (the machine running SAP LaMa). This gives VM1 itself an Azure AD identity with automatically rotated credentials - no secrets to store or rotate manually. System-assigned is used here (not user-assigned) because the identity is scoped to exactly one resource (VM1), which is the simpler and lower-overhead choice.
Step 3 - Assign the Contributor role to the managed identity for the subscription
Only after the managed identity exists can you assign it a role. Contributor grants full create/update/delete rights over Azure resources (needed to deploy VMs) without giving rights-management permissions. Scoping to the subscription gives SAP LaMa the reach to manage workloads across resource groups.
Why the Rejected Options Are Wrong
| Item | Why excluded |
|---|---|
| User-assigned managed identity | Requires an extra step to attach to VM1; system-assigned is simpler for a single VM |
| Create an SAP LaMa connector | This is the final step done inside SAP LaMa after Azure is configured - it comes 4th, not within the Azure portal steps |
Common Mistakes
- Skipping the app registration - Candidates assume managed identity alone is sufficient, but SAP LaMa's connector configuration specifically requires an Azure AD application registration for its authentication flow.
- Assigning the role before creating the identity - You cannot assign RBAC to an identity that doesn't exist yet; Step 3 is always blocked by Step 2.
- Choosing user-assigned managed identity - The question says minimize effort; user-assigned requires creating and attaching separately, whereas system-assigned is enabled in one click on VM1.
- Including the LaMa connector step - That's an in-product step, not an Azure portal action, so it doesn't belong in this sequence even though it is a required step overall.
Topics
Community Discussion
No community discussion yet for this question.