You have an Azure subscription linked to a Microsoft Entra tenant. The subscription contains 10 virtual machines that run Windows Server 2019 and host Microsoft SQL Server 2022 instances. You need…

Question

Options

• AEnable a user-assigned managed identity on each virtual machine.
• BDeploy a Microsoft Entra Domain Services domain and join the virtual machines to the domain.
• CEnable a system-assigned managed identity on each virtual machine.
• DJoin the virtual machines to the Microsoft Entra tenant.

• A
  5% (2)
• B
  84% (36)
• C
  9% (4)
• D
  2% (1)

Explanation

Explanation

Deploying Microsoft Entra Domain Services (AADS) and joining the virtual machines to that domain is the correct first step because it establishes a centralized identity and authentication infrastructure, allowing a single domain user account to authenticate and manage SQL Server instances across all 10 VMs using Windows Authentication. Without a shared domain, each SQL Server instance manages its own local authentication, making unified single-account management impossible.

Why the distractors are wrong:

• A (User-assigned managed identity): Managed identities are designed for Azure resource-to-resource authentication (e.g., an app accessing Key Vault), not for interactive user-based SQL Server management across multiple VMs.
• C (System-assigned managed identity): Same limitation as user-assigned - system-assigned managed identities are tied to a single resource and cannot be used as a shared user account for SQL Server management.
• D (Join VMs to Microsoft Entra tenant): Standard Microsoft Entra Join enables device management but does not provide the domain-based Windows Authentication that SQL Server requires for centralized account management; Entra Domain Services is needed for that LDAP/Kerberos capability.

Memory Tip: Think of it this way - "Domain Services = Domain User = SQL Login." Whenever a question asks about managing multiple on-premises-style services (like SQL Server) with a single account, Entra Domain Services is the bridge that brings traditional Active Directory functionality to the cloud.

No community discussion yet for this question.