Hotspot Question You have an Azure subscription that contains the resources shown in the following table. You create a Microsoft Entra user named User1. Which identities can you add to VM1 and App1?…

Question

Exhibit

Answer Area

• VM1:
  User1 onlyManaged2 onlyManaged1 and Managed2 onlyManaged2 and User1 onlyManaged1, Managed2, and User1
• App1:
  User1 onlyManaged2 onlyManaged2 and User1 onlyA system-assigned managed identity onlyA system-assigned managed identity and Managed2 onlyA system-assigned managed identity, Managed2, and User1

Explanation

This question tests knowledge of managed identities for Azure resources and Microsoft Entra identities that can be assigned to Virtual Machines and App Services (App1). VM1 supports system-assigned and user-assigned managed identities, while App1 (App Service) also supports both types of managed identities.

Approach. For VM1 (Azure Virtual Machine): You can assign a System-Assigned Managed Identity (created and tied to the VM lifecycle) and/or a User-Assigned Managed Identity (a standalone identity resource that can be shared across multiple resources). A Microsoft Entra user (User1) cannot be 'added' as an identity to a VM in the managed identity sense - users are separate principals used for RBAC role assignments, not assigned as the resource's identity. For App1 (Azure App Service): Similarly, App Service supports both System-Assigned and User-Assigned Managed Identities. The User-Assigned Managed Identity (shown as a resource in the subscription table) can be added to both VM1 and App1, making it the shared identity option. System-Assigned identities are resource-specific and cannot be shared. User1 (a Microsoft Entra user) cannot be assigned as a managed identity to either resource.

Concept tested. Azure Managed Identities (System-Assigned vs User-Assigned) and which identity types can be associated with Azure Virtual Machines and Azure App Services. The key distinction is that only managed identity types (system-assigned or user-assigned) can be assigned as the identity of a resource, while Microsoft Entra users are used for RBAC and authentication but are not assignable as resource identities.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

No community discussion yet for this question.