Can a shared user-assigned identity let VM1 and VM2 access storage1?

Secure access to resources by using Microsoft Entra ID Implement security for storage accounts

Answer Correct answer: A — Assigning a shared user-assigned managed identity to VM1 and VM2 and granting it an RBAC role on storage1 lets both VMs authenticate to the storage account.

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled. You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1. You need to ensure that VM1 and VM2 can access storage1. Solution: You create a user-assigned managed identity, assign the identity to each virtual machine, and then add each managed identity to a role on storage1. Does this meet the goal?

Yes Correct Answer
No

Community Insight

The exam tests whether you recognize that a user-assigned managed identity can be attached to multiple VMs and authorized on a storage account, while the common trap is assuming existing system-assigned identities make the solution invalid.

This SC-500 scenario asks whether assigning a shared user-assigned managed identity to VM1 and VM2, then granting that identity an RBAC role on storage1, satisfies the requirement that both VMs access storage1. The answer is yes, provided the role grants the required storage data-plane permissions.

A common mistake is answering No because VM1 and VM2 already have system-assigned identities; managed identities are additive, and a shared user-assigned identity with a storage RBAC role still grants both VMs access.

Community Discussion (2 comments)

[email protected] 👍 1 Selected: A

What is the goal? "You need to ensure that VM1 and VM2 can access storage1." Existing situation: - VM1 and VM2 both have system-assigned managed identities. - Public access from all networks is enabled for storage1. Suggested solution from the question: You create a user-assigned managed identity, assign the identity to each virtual machine, and then add each managed identity to a role on storage1. Does this solution achieve the goal? Yes. But at what cost? 1. It is recommended to use user-assigned managed identity if multiple VMs need to access the same resource because we can assign a single user-assigned managed identity to both VMs. 2. If public access from all networks is enabled, anyone can read the contents of storage1 already. So there is no need to assign a role.

Alphazeero1 👍 1 Selected: A

Yes. A user-assigned managed identity can be shared by VM1 and VM2 and granted access to storage1 through an appropriate role assignment. The existing system-assigned identities do not make this solution invalid. Important: The role must grant the required storage data access, not merely management access. Managed identities authenticate through Microsoft Entra ID and receive permissions through Azure RBAC. Exam tip: The question asks whether the solution works, not whether it is the simplest. Using the existing identities could avoid creating another identity, but the proposed solution still meets the goal.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The requirement is only that VM1 and VM2 can access storage1, and the proposed solution gives both VMs a user-assigned managed identity that is then authorized on storage1 with an RBAC role. A user-assigned managed identity can be assigned to multiple Azure VMs, so both VM1 and VM2 can authenticate as that identity to Azure Storage. Since storage1 has public access enabled, network reachability is not the blocker; the role assignment supplies the needed authorization, assuming it grants the required storage data-plane permissions such as a Storage Blob Data role. Existing system-assigned identities are irrelevant and do not prevent adding a user-assigned identity.

Why the Other Options Are Wrong

The only other option is "No," which would be correct only if the solution failed to grant access. A No answer usually rests on the mistaken idea that the pre-existing system-assigned identities block a user-assigned identity, but managed identities are additive. Another mistaken basis is that a storage account role cannot grant data access, but Entra ID RBAC roles can authorize managed identities for Azure Storage data-plane operations. Therefore, No is not supported by the scenario.

Community Comment Notes

One commenter focuses on the exact goal wording, "You need to ensure that VM1 and VM2 can access storage1," and notes that public access from all networks is already enabled, so the goal is access rather than network isolation. Alphazeero1 answers Yes and states that "The existing system-assigned identities do not make this solution invalid," emphasizing that the role must grant the required storage data access rather than only management access. This aligns with the analysis that a shared user-assigned identity with an appropriate RBAC role on storage1 satisfies the requirement.

Official Reference

Exam Strategy

For yes/no solution questions, restate the goal literally before evaluating the steps; here the goal is access to storage1, not removal of public network access. Then check whether the identity can be attached to both VMs and whether the role assignment provides storage data-plane permissions.

Frequently Asked Questions

Why is the solution correct when VM1 and VM2 already have system-assigned managed identities?

They can coexist; adding a shared user-assigned identity does not remove the existing system-assigned identities, and that shared identity can be granted an RBAC role on storage1.

Does the RBAC role on storage1 need to be a storage data-plane role such as Storage Blob Data Reader?

Yes. To let the managed identity read blob data, assign a data-plane role like Storage Blob Data Reader; management-plane roles such as Reader do not grant blob data access.

More SC-500 FAQ →

Related Analysis

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide