AZ-104 Certification Practice Question #66

Question

You have an Azure subscription named Subscription1 that contains an Azure virtual machine named VM1. VM1 is in a resource group named RG1.
VM1 runs services that will be used to deploy resources to RG1.
You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1.
What should you do first?

Accepted Answer

To allow a service running inside VM1 to manage resources in RG1 using VM1's identity, you must leverage Azure Managed Identities. By default, virtual machines do not have a managed identity enabled. Therefore, the first step is to enable a system-assigned managed identity on VM1 by modifying its identity settings in the Azure portal (Option A). Once enabled, VM1's service principal is registered in Microsoft Entra ID. The second step would then be to go to the Access Control (IAM) page of resource group RG1 (Option B) and assign VM1's managed identity the appropriate RBAC role (such as Contributor) so that VM1 can manage the resources.

More AZ-104 practice questions