Does adding VM1 and VM2 to a storage1 role meet the goal?

SC-500 By islever Editorial Last updated Oct 17, 2026

Secure access to resources by using Microsoft Entra ID Implement security for storage accounts

Short answer

B Assigning a role to the VM resource is invalid; the role must be assigned to each VM's system-assigned managed identity on storage1.

Question

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled.
You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.
You need to ensure that VM1 and VM2 can access storage1.
Solution: You add each virtual machine to a role on storage1.
Does this meet the goal?

Yes
No Correct Answer

Key Takeaways

Tests Azure RBAC principal targeting for storage access; the trap is treating the VM resource as the role-assignable object instead of its system-assigned managed identity.

This SC-500 scenario tests whether adding VM1 and VM2 directly to a role on storage1 grants access through their system-assigned managed identities. It establishes that the role must be assigned to each managed identity principal, so the proposed solution does not meet the goal.

Common mistake: The common mistake is reading "add each virtual machine to a role" literally and selecting the VM resource; Azure RBAC assignments must target the VM's managed identity service principal on storage1.

Expert Analysis

Why the Answer Is Correct

The solution does not meet the goal because Azure RBAC role assignments are made to security principals—users, groups, service principals, or managed identities—not to the virtual machine resource. VM1 and VM2 each have a system-assigned managed identity, so the correct action is to assign a role such as Storage Blob Data Reader to each managed identity at the storage1 scope. Enabling public network access on storage1 only affects network reachability; it does not authorize the VM identities to read blob data. Because the stated solution targets the VM object rather than the identity, it is technically incorrect.

Why the Other Options Are Wrong

Option A would be correct only if the solution explicitly said the role was assigned to each VM's managed identity; "add each virtual machine to a role" conflates the compute resource with its Entra ID service principal. There is no supported RBAC assignment that makes the VM resource itself the principal on storage1. Even with public access from all networks enabled, the identities still need a data-plane role for blob, file, queue, or table access.

Community Comment Notes

Craigg argued for No, explaining that "A role needs to be assigned to a managed identity not a virtual machine" and emphasizing the identity-versus-resource distinction. Alphazeero1 read the same wording as shorthand for selecting each VM's identity and therefore chose Yes, which is a reasonable interpretation of the portal workflow but not of the precise exam wording. The exchange highlights the exact trap Microsoft is testing: whether you recognize the managed identity as the RBAC principal.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

For "does this meet the goal" items, check the exact security principal named in the role assignment, not just whether managed identity is enabled. If the solution names the VM resource rather than its identity, treat it as incorrect unless the wording explicitly says the identity is selected.

Frequently Asked Questions

Why is assigning the role to the VM resource not the same as its managed identity?

Azure RBAC assigns roles to security principals; a system-assigned managed identity is a separate service principal tied to the VM, not the VM resource object itself.

Does enabling public access from all networks let VM1 and VM2 read storage1 without an RBAC role?

No. Network access only makes the storage endpoint reachable; managed identity authentication still requires a data-plane role such as Storage Blob Data Reader on storage1.

More SC-500 FAQ →

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

Craigg 👍 3 Answered B

A role needs to be assigned to a managed identity not a virtual machine. Identity vs. Resource: In Azure, you assign roles to security principals (like a managed identity enabled on a VM), not to the virtual machine resource itself
3lVhylla 👍 1 Answered B

The solution is worded incorrectly. You can’t add a virtual machine to a role on a storage account. In Azure RBAC, you create a role assignment; you assign a role, such as Storage Blob Data Reader or Storage Blob Data Contributor, to a security principal here, each VMs system-assigned managed identity at a scope storage1. The question says to add each virtual machine to a role, which isn’t how Azure RBAC works, so the solution doesn’t meet the goal as stated. For comparison, the version that would meet the goal is: You assign a role to the managed identity of each virtual machine on storage1.
Greens 👍 1 Answered A

Public network access is already enabled on storage1, so the network isn’t in the way. What’s missing is authorization. Both VMs have system-assigned managed identities, so you can assign each identity an Azure RBAC role on storage1, such as Storage Blob Data Reader or Storage Blob Data Contributor. The VMs then get Entra ID tokens through their managed identities and can access the storage account. One point to watch: the role has to be a data-plane role (Storage Blob/Queue/Table/File Data …). A control-plane role like Reader only lets them see the account’s properties, not the data in it.
Alphazeero1 👍 1 Answered A

A. Yes. Because both VMs have system-assigned managed identities, you can select each VM’s identity and assign it an appropriate role on storage1. This grants the identities access to the storage account. Key distinction: “Add each virtual machine to a role” means assigning the role to its managed identity, not to the VM resource itself. For storage data access, the selected role must grant the required data permissions.
Greens 👍 1 Answered A

Each VM has a system-assigned managed identity, which is its identity in Entra ID. When you “add the VM to a role” on storage1, you’re really assigning that role to the VM’s managed identity. With a data role such as Storage Blob Data Contributor, both VMs can access storage1. Network access is already open, because public access is enabled.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide