Azure User-Assigned Managed Identity Regional Scope
Answer
Correct answer: D — VM1, storage1, and WebApp1 can all use Managed1 because user-assigned managed identities are usable by any supported resource type globally.
You have an Azure subscription that contains a user-assigned managed identity named Managed1 in the East US Azure region. The subscription contains the resources shown in the following table. Which resources can use Managed1 as their identity? - 
azure managed identity scope
user assigned managed identity region
azure storage managed identity
sc-300 managed identity question
Community Votes
55% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the understanding that while user-assigned managed identities are created as regional resources, their associated service principal is available globally for use by any supported resource type.
Determines which Azure resources can utilize a user-assigned managed identity regardless of geographic region, establishing that the identity's scope is global. This page clarifies that VMs, Storage Accounts, and Web Apps all support this feature.
Selecting Option C (VM1 and WebApp1 only) because learners incorrectly assume that Storage Accounts cannot be assigned managed identities or confuse regional creation with usage restrictions.
Community Discussion (17 comments)
wheeldj
👍 12
Selected: D
Answer D is correct I think. see link "In short, yes you can use user assigned managed identities in more than one Azure region. The longer answer is that while user assigned managed identities are created as regional resources the associated service principal (SP) created in Microsoft Entra ID is available globally" https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq
NICKTON81
👍 6
Selected: C
C is correct https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-status https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq
bardock100
👍 1
Selected: B
Copliot: You have an Azure subscription that contains a user-assigned managed identity named Managed1 in the East US Azure region. The subscription contains the resources shown in the following table. Name Type Location vm1 virtual machine west us storage1 storage account east us webapp1 azure app service app east us Which resources can use Managed1 as their identity? A. WebApp1 only B. storage1 and WebApp1 only C. VM1 and WebApp1 only D. VM1, storage1, and WebApp1 Given that Managed1 is in the East US region, only resources in the same region can use it. Therefore, the correct answer is: B. storage1 and WebApp1 only If you have any more questions or need further clarification, feel free to ask!
_marc
👍 2
Selected: C
A storage account is not an actor, that is, it doesn't initiate any connection to another cloud service. Rather it is passive and allows access from other services. The storage account would have a RBAC role allowing other managed identities to accces it, but there is no need for a storage account to have its own managed identity.
Oskarma
👍 1
Selected: D
You can assign a user-assigned managed identity in a storage account and in different regions (tested in my tenant). So, D.
test123123
👍 1
Selected: D
https://learn.microsoft.com/en-us/azure/search/search-howto-managed-identities-storage#user-assigned-managed-identity
c3e0fc1
👍 2
Selected: C
You cannot add a -USER-assigned managed identity to a storage account. Since you can do that to a VM, the only answer is C.
hml_2024
👍 1
This is from ChatGPT. To determine which resources can use the Managed1 user-assigned managed identity, we need to consider that a user-assigned managed identity can only be assigned to resources in the same Azure region where it was created. Managed1 is in the East US region, so it can only be assigned to resources that are also in the East US region. Looking at the table: VM1 is in the West US region, so it cannot use Managed1. storage1 is in the East US region, so it can use Managed1. WebApp1 is in the East US region, so it can use Managed1. Therefore, the correct answer is: B. storage1 and WebApp1 only.
jarattdavis
👍 2
B is correct Answer: The resources that can use Managed1 are those also in the East US region. Therefore, storage1 and WebApp1 in East US can use Managed1 as their identity
jim85
👍 2
D is the answer, user assigned managed identity can be used in other regions: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq
NotanAdmin
👍 2
D. VM1, storage1, and WebApp1 Copilot says: User-assigned managed identities can be used by multiple resources in Azure, and they are not restricted to a specific region. Therefore, Managed1 can be used by VM1, Storage1, and WebApp1 as their identity, regardless of the region they are in. The correct answer is: D. VM1, storage1, and WebApp1
bpaccount
👍 4
How the hell are people supposed to get this question right in an proctored semi closed book exam, if us here, with access to Internet/Google/ChatGPT/CoPilot, can't even find the right answer :-D
klayytech
👍 4
Selected: D
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview see the video starting from M 10 storage account also can.
spatrick
👍 1
Explain how to add a user assigned managed identity: https://microsoftlearning.github.io/Secure-storage-for-Azure-Files-and-Azure-Blob-Storage/Instructions/Labs/LAB_04_storage_web_app.html
wheeldj
👍 2
Answer D is correct I think. see link "In short, yes you can use user assigned managed identities in more than one Azure region. The longer answer is that while user assigned managed identities are created as regional resources the associated service principal (SP) created in Microsoft Entra ID is available globally" https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identities-faq
klayytech
👍 3
Selected: C
So, the resources that can use Managed1 as their identity are: VM1 WebApp1 (Azure App Service app) note : 1- the Storage account dont have managed identity 2- managed identity assigned to all region Therefore, the correct answer is B. storage1 and WebApp1 only.
Nielll
👍 2
Selected: C
Managed1 is a user-assigned managed identity, it can only be assigned to resources in the same region. So, Managed1 can only be assigned to resources within the East US region. Therefore its C
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correct answer: D — VM1, storage1, and WebApp1. User-assigned managed identities are Azure resources that can be granted to one or more Azure services. While the managed identity object itself is stored in a specific region (East US), the underlying Microsoft Entra ID service principal it represents is available globally. Therefore, any Azure resource that supports managed identities—such as Azure Virtual Machines (VM1), Azure App Service (WebApp1), and Azure Storage Accounts (storage1)—can be assigned this identity regardless of the resource's own region. The key constraint is resource type compatibility, not geographic proximity.Why the Other Options Are Wrong
Option A is incorrect because both VMs and Storage Accounts can also use managed identities. Option B is incorrect because VMs are fully supported users of managed identities. Option C is incorrect because it excludes Storage Accounts; many learners mistakenly believe storage accounts do not support managed identities, but they do for authentication purposes. The confusion often stems from thinking about RBAC roles versus the identity assignment capability.Community Comment Notes
Community discussion shows a split between options C and D. Several users pointed out that storage accounts cannot be 'actors' in certain contexts, leading them to choose C. However, others cited official Microsoft documentation confirming that user-assigned managed identities are usable across regions and by storage accounts. One commenter noted that the service principal is global, which directly supports the correct answer D. Another user highlighted that the video overview confirms storage account compatibility.Official Reference
Exam Strategy
When analyzing managed identity questions, distinguish between the creation location (regional) and the usage scope (global). Always verify if the target resource type (e.g., Storage, VM, App Service) supports managed identities, as this is the primary filter rather than region matching.
Frequently Asked Questions
Are user-assigned managed identities restricted to the region where they are created?
No. While the identity resource is stored in a specific region, the associated Microsoft Entra ID service principal is available globally.
Can an Azure Storage Account be assigned a user-assigned managed identity?
Yes. Azure Storage Accounts support both system-assigned and user-assigned managed identities for authentication.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →