Exam SC-300 topic 1 question 74 discussion

Answer D is correct I think. see link "In short, yes you can use user assigned managed identities in more than one Azure region. The longer answer is that while user assigned managed identities are created as regional resources the associated service principal (SP) created in Microsoft Entra ID is available globally" https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq

C is correct https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-status https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq

A is the answer -Storage accounts do not use managed identities directly. Managed identities will be used by -applications or services to access storage securely. - Despite any managed identity residing in Entra Id and being globally available, user assigned managed identity can only be used in the region it was created in and can be shared amongst multiple resources. So VM1 cannot be used by the user created managed identity in East US. -Azure app service in East can leverage the user-assigned managed identity.

Copliot: You have an Azure subscription that contains a user-assigned managed identity named Managed1 in the East US Azure region. The subscription contains the resources shown in the following table. Name Type Location vm1 virtual machine west us storage1 storage account east us webapp1 azure app service app east us Which resources can use Managed1 as their identity? A. WebApp1 only B. storage1 and WebApp1 only C. VM1 and WebApp1 only D. VM1, storage1, and WebApp1 Given that Managed1 is in the East US region, only resources in the same region can use it. Therefore, the correct answer is: B. storage1 and WebApp1 only If you have any more questions or need further clarification, feel free to ask!

A storage account is not an actor, that is, it doesn't initiate any connection to another cloud service. Rather it is passive and allows access from other services. The storage account would have a RBAC role allowing other managed identities to accces it, but there is no need for a storage account to have its own managed identity.

You can assign a user-assigned managed identity in a storage account and in different regions (tested in my tenant). So, D.

https://learn.microsoft.com/en-us/azure/search/search-howto-managed-identities-storage#user-assigned-managed-identity

You cannot add a -USER-assigned managed identity to a storage account. Since you can do that to a VM, the only answer is C.

This is from ChatGPT. To determine which resources can use the Managed1 user-assigned managed identity, we need to consider that a user-assigned managed identity can only be assigned to resources in the same Azure region where it was created. Managed1 is in the East US region, so it can only be assigned to resources that are also in the East US region. Looking at the table: VM1 is in the West US region, so it cannot use Managed1. storage1 is in the East US region, so it can use Managed1. WebApp1 is in the East US region, so it can use Managed1. Therefore, the correct answer is: B. storage1 and WebApp1 only.

B is correct Answer: The resources that can use Managed1 are those also in the East US region. Therefore, storage1 and WebApp1 in East US can use Managed1 as their identity

D is the answer, user assigned managed identity can be used in other regions: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq

D. VM1, storage1, and WebApp1 Copilot says: User-assigned managed identities can be used by multiple resources in Azure, and they are not restricted to a specific region. Therefore, **Managed1** can be used by **VM1**, **Storage1**, and **WebApp1** as their identity, regardless of the region they are in. The correct answer is: D. VM1, storage1, and WebApp1

How the hell are people supposed to get this question right in an proctored semi closed book exam, if us here, with access to Internet/Google/ChatGPT/CoPilot, can't even find the right answer :-D

https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview see the video starting from M 10 storage account also can.

Explain how to add a user assigned managed identity: https://microsoftlearning.github.io/Secure-storage-for-Azure-Files-and-Azure-Blob-Storage/Instructions/Labs/LAB_04_storage_web_app.html

Answer D is correct I think. see link "In short, yes you can use user assigned managed identities in more than one Azure region. The longer answer is that while user assigned managed identities are created as regional resources the associated service principal (SP) created in Microsoft Entra ID is available globally" https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq

So, the resources that can use Managed1 as their identity are: VM1 WebApp1 (Azure App Service app) note : 1- the Storage account dont have managed identity 2- managed identity assigned to all region Therefore, the correct answer is B. storage1 and WebApp1 only.