Does adding VM1 and VM2 to a storage1 role meet the goal?

Secure access to resources by using Microsoft Entra ID Implement security for storage accounts

Answer Correct answer: B — Assigning a role to the VM resource is invalid; the role must be assigned to each VM's system-assigned managed identity on storage1.

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled. You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1. You need to ensure that VM1 and VM2 can access storage1. Solution: You add each virtual machine to a role on storage1. Does this meet the goal?

Yes
No Correct Answer

Community Insight

Tests Azure RBAC principal targeting for storage access; the trap is treating the VM resource as the role-assignable object instead of its system-assigned managed identity.

This SC-500 scenario tests whether adding VM1 and VM2 directly to a role on storage1 grants access through their system-assigned managed identities. It establishes that the role must be assigned to each managed identity principal, so the proposed solution does not meet the goal.

The common mistake is reading "add each virtual machine to a role" literally and selecting the VM resource; Azure RBAC assignments must target the VM's managed identity service principal on storage1.

Community Discussion (2 comments)

Craigg 👍 3 Selected: B

A role needs to be assigned to a managed identity not a virtual machine. Identity vs. Resource: In Azure, you assign roles to security principals (like a managed identity enabled on a VM), not to the virtual machine resource itself

Alphazeero1 👍 1 Selected: A

A. Yes. Because both VMs have system-assigned managed identities, you can select each VM’s identity and assign it an appropriate role on storage1. This grants the identities access to the storage account. Key distinction: “Add each virtual machine to a role” means assigning the role to its managed identity, not to the VM resource itself. For storage data access, the selected role must grant the required data permissions.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The solution does not meet the goal because Azure RBAC role assignments are made to security principals—users, groups, service principals, or managed identities—not to the virtual machine resource. VM1 and VM2 each have a system-assigned managed identity, so the correct action is to assign a role such as Storage Blob Data Reader to each managed identity at the storage1 scope. Enabling public network access on storage1 only affects network reachability; it does not authorize the VM identities to read blob data. Because the stated solution targets the VM object rather than the identity, it is technically incorrect.

Why the Other Options Are Wrong

Option A would be correct only if the solution explicitly said the role was assigned to each VM's managed identity; "add each virtual machine to a role" conflates the compute resource with its Entra ID service principal. There is no supported RBAC assignment that makes the VM resource itself the principal on storage1. Even with public access from all networks enabled, the identities still need a data-plane role for blob, file, queue, or table access.

Community Comment Notes

Craigg argued for No, explaining that "A role needs to be assigned to a managed identity not a virtual machine" and emphasizing the identity-versus-resource distinction. Alphazeero1 read the same wording as shorthand for selecting each VM's identity and therefore chose Yes, which is a reasonable interpretation of the portal workflow but not of the precise exam wording. The exchange highlights the exact trap Microsoft is testing: whether you recognize the managed identity as the RBAC principal.

Official Reference

Exam Strategy

For "does this meet the goal" items, check the exact security principal named in the role assignment, not just whether managed identity is enabled. If the solution names the VM resource rather than its identity, treat it as incorrect unless the wording explicitly says the identity is selected.

Frequently Asked Questions

Why is assigning the role to the VM resource not the same as its managed identity?

Azure RBAC assigns roles to security principals; a system-assigned managed identity is a separate service principal tied to the VM, not the VM resource object itself.

Does enabling public access from all networks let VM1 and VM2 read storage1 without an RBAC role?

No. Network access only makes the storage endpoint reachable; managed identity authentication still requires a data-plane role such as Storage Blob Data Reader on storage1.

More SC-500 FAQ →

Related Analysis

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide