Exam AZ-301 topic 2 question 14 discussion

Box 1 should be user assigned managed identity as the requirement states 'ensure that the applications can authenticate by using the same Azure Active Directory (Azure AD) identity'. If we use a system assigned managed identity, it would create different ad identities for each VM

Answer correct. 1. System assigned 2. Metadata Service ID

1 - Create a user Assigned Managed Identities for Azure resources 2 - An Azure Instance Metadata Service Identity

Box 1 : 1 Box 2: 3 correct answer

- System Assigned Managed Identity (As System Assigned allows for it to tagged to instance automatically, currently instance in question is just VM, hence it will minimize administration effort and follow lifecycle management process of VM, i.e. when VMs are deleted managed identity also get deleted) - Azure Instance Metadata Service Identity

System-Assigned Managed Identity vs. User-Assigned Identity They are the same in the way they work. The only difference is that if you enable System-Assigned Managed Identity for an Azure resource, the Managed Identity gets automatically created and assigned to that Azure resource, and will also get deleted when you delete the resource. User-Assigned Managed Identity is created manually and likewise manually assigned to an Azure resource. The lifecycle of a User-Assigned Managed Identity is NOT tied to the lifecycle of the Azure resource to which it is assigned. That means it the Azure resource gets deleted, the User-Assigned Managed Identity will not be deleted from Azure.

A system assigned managed identity can be enabled on the VM or one or more user assigned managed identities can be assigned to the VM. Tokens for managed identities can then be requested from Instance Metadata Service. These tokens can be used to authenticate with other Azure services such as Azure Key Vault. System assigned Metadata service

Box1: Create a user-asssigned Managed Identities for Azure Resources (https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) Box 2: An Azure Instance Metadata Service Identity (https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)

1. "user assigned managed identity" -- has to be the same id for all VMs so cannot be system assigned. 2. Outh2 is authorization "not" authentication -- authenticate using Azure Instance Metadata Service (IMDS) which is accessible only from within the VM. Ref. https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview#how-does-the-managed-identities-for-azure-resources-work

It is in my exam, there was only 3 options for box 3, and last one is Metadata Service ID Oauth Ednpoint, which is the correct answer.

Answer is: User and IDMS. To minimize admin operations, user assigned act like a group of VMs. So we can easily rule them.

1. User Assigned Managed Identities 2. Azure Instance Metadata Service Identity Quote from: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service#managed-identity-via-metadata-service A system assigned managed identity can be enabled on the VM or one or more user assigned managed identities can be assigned to the VM. Tokens for managed identities can then be requested from Instance Metadata Service. These tokens can be used to authenticate with other Azure services such as Azure Key Vault.

Given Answer is Correct

Given Answer is Correct

Box1: User-assigned managed identity- Can be shared-The same user-assigned managed identity can be associated with more than one Azure resource. Workloads that run on multiple resources and which can share a single identity. Box-2 Azure Instance Metadata Service Identity- Your code that's running on the VM can request a token from the Azure Instance Metadata Service identity endpoint, accessible only from within the VM. https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

box-1 user assigned managed identity box-2 Azure Instance Metadata Service (IMDS) identity endpoint user assigned managed identity can be used with multiple VMs. see https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/msi-tutorial-linux-vm-access-arm

Applications can authenticate and minimize admin effort... using the same Azure Active Directory (Azure AD) identity not necessarily mean users.. This should be System-assigned managed identity.