SC-300 Certification Practice Question #59

Question

You have an Azure subscription that contains a user-assigned managed identity named Managed1 in the East US Azure region. The subscription contains the resources shown in the following table.

Which resources can use Managed1 as their identity?

Accepted Answer

Two independent facts decide this. (1) By default a user-assigned managed identity's isolation scope is `None`, so it can be used across regions — VM1 in West US can therefore use the East US Managed1, which defeats the "same-region-only" reasoning behind the B and A answers. (2) A storage account is a passive *target* resource and cannot be assigned a managed identity as its own identity (managed identities attach to *source* resources such as VMs and App Services). That removes storage1 and removes the D answer. What remains are VM1 and WebApp1 = **C**. The community is genuinely split (D drew 14+10 👍 on the cross-region point), but those D voters overlooked that storage1 can't carry the identity; the official Suggested Answer, the 21-vote majority, and the two 7-👍 comments all converge on C, backed by MS Learn on both points. Confidence is held at 84 rather than higher because of the sizable, partly-valid D camp.

More SC-300 practice questions