Question
You have an Azure subscription named sub1 and 500 on-premises virtual machines that run Windows Server.
You plan to onboard the on-premises virtual machines to Azure Arc by running the Azure Arc deployment script.
You need to create an identity that will be used by the script to authenticate access to sub1. The solution must use the principle of least privilege.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation
Command for creating identity: New-AzADServicePrincipal — The Azure Arc "at-scale" onboarding script authenticates non-interactively to sub1 with a Microsoft Entra service principal, and New-AzADServicePrincipal creates the app registration plus its service principal object and secret in one step. New-AzADAppCredential only adds credentials to an app registration that already exists, and New-AzUserAssignedIdentity creates a managed identity, which is an Azure resource that can only be assigned to Azure resources and therefore cannot be used by a script running on an on-premises virtual machine.
Role for the identity: 'Azure Connected Machine Onboarding' — This built-in role grants exactly the permissions needed to read and create Azure Arc-enabled server resources (Microsoft.HybridCompute/machines write and read), which satisfies the least-privilege requirement for a one-time onboarding of the 500 servers. 'Virtual Machine Contributor' is far broader and targets Azure VM resources rather than Arc-enabled servers, and 'Virtual Machine User Login' only grants sign-in rights to an already-registered machine, not the ability to register one.
