A single water-quality VM must read one storage account, and the team does not want a leftover identity after the VM is decommissioned. Which identity approach should the security engineer enable?
Select an answer to reveal the explanation.
Short Explanation
One lonely water-quality VM? Flip on system-assigned identity—when you scrap the VM, the identity walks out the door with it. No orphan badges.
Full Explanation
A system-assigned managed identity is tied to a single Azure resource: Azure creates the service principal when the identity is enabled and deletes it when the resource is deleted. That matches a one-VM workload where leftover identity is unacceptable. User-assigned identities are standalone resources with independent lifecycles. Storage account keys and disk encryption address different controls and do not provide an Entra identity that is removed with the VM.