nerdexam
Microsoft

SC-300 · Question #418

Hotspot Question You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains three users named User1, User2 and User3. You have the devices shown in the following…

The correct answer is User1 can sign in to VM1 from Device1 by using their Microsoft Entra credentials. = Yes; User2 can sign in to VM1 from Device2 by using their Microsoft Entra credentials. = No; User3 can sign in to VM3 from Device3 by using their Microsoft Entra credentials. = No. This question tests knowledge of Microsoft Entra ID (Azure AD) login for Azure VMs, specifically which roles allow interactive login versus administrative login, and how device join status affects the ability to use VM Sign-In roles.

Submitted by ravi_2018· Mar 6, 2026Implement authentication and access management solution

Question

Hotspot Question You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains three users named User1, User2 and User3. You have the devices shown in the following table. You deploy a virtual machine that has the following configurations: - Name: VM1 - Resource group: RG1 - Operating system: Windows Server - Login with Microsoft Entra ID: Enabled You have the Azure role assignments shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Answer Area

  • User1 can sign in to VM1 from Device1 by using their Microsoft Entra credentials.Yes
  • User2 can sign in to VM1 from Device2 by using their Microsoft Entra credentials.No
  • User3 can sign in to VM3 from Device3 by using their Microsoft Entra credentials.No

Explanation

This question tests knowledge of Microsoft Entra ID (Azure AD) login for Azure VMs, specifically which roles allow interactive login versus administrative login, and how device join status affects the ability to use VM Sign-In roles.

Approach. When 'Login with Microsoft Entra ID' is enabled on a VM, users need specific Azure RBAC roles to sign in: 'Virtual Machine User Login' (standard user access) or 'Virtual Machine Administrator Login' (admin/RDP with local admin rights). A user assigned 'Virtual Machine Administrator Login' on RG1 can sign in to VM1 as a local administrator. A user assigned 'Virtual Machine User Login' can sign in as a standard user. Users with only 'Contributor' or 'Owner' roles on the resource group do NOT automatically get the ability to sign in interactively via Entra ID - they need the specific VM login roles. Additionally, to connect using Microsoft Entra ID authentication to a Windows VM, the client device must be either Microsoft Entra joined, hybrid Entra joined, or Microsoft Entra registered to the same tenant. If a device is not joined/registered to the tenant, the user cannot use Entra ID-based VM login from that device. Typically: Statement 1 (User with VM Administrator Login role can sign in to VM1) = Yes; Statement 2 (User with VM User Login role can sign in to VM1) = Yes; Statement 3 (User without VM login role but with Contributor can sign in) = No.

Concept tested. Microsoft Entra ID (Azure AD) VM Sign-In roles: 'Virtual Machine Administrator Login' and 'Virtual Machine User Login' are required for interactive Entra ID-based authentication to Azure VMs. Standard roles like Contributor or Owner do not grant VM sign-in capability. Device compliance and join status also affect eligibility to use Entra ID VM login.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows

Topics

#VM login with Entra ID#Azure role assignments#device compliance#Microsoft Entra credentials

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-300 Practice