A platform team runs a fleet of virtual machines and Azure Functions that must all authenticate to the same storage account and Azure SQL database with one identity, so that a single role assignment grants access to every workload. They also want to provision the identity and grant its permissions before any of the compute resources exist. Which workload identity meets these requirements?
- AA separate system-assigned managed identity enabled on each virtual machine and function, with the same role assignment repeated for every identity.
- BA single user-assigned managed identity created first, granted the required roles, then attached to each virtual machine and function. Correct
- CAn app registration shared across the workloads, with its client secret distributed to each virtual machine and function for authentication.
- DA workload identity federation trust on each function and virtual machine that maps to one external service principal in another tenant.
Why A is wrong: System-assigned identities are unique per resource and cannot be shared, so the team would manage many identities and many role assignments rather than one, and none can exist before its resource.
Why B is correct: A user-assigned managed identity is a standalone object that can be created and granted roles before any compute exists, then assigned to many resources so one identity and one role assignment cover the whole fleet.
Why C is wrong: An app registration can be shared, but distributing a client secret to every workload reintroduces credential management and rotation, which managed identities are designed to remove.
Why D is wrong: Workload identity federation establishes trust for external workloads to use a service principal without secrets, but it does not provide one shared Azure identity provisioned ahead of the compute resources for an internal fleet.