Virtual machines run code that needs access to resources in an Azure resource group. You granted the VM a system-assigned managed identity in Resource Manager. To obtain an access token that uses the VM's managed identity, which two actions should you take? (Each correct answer is part of the solution.)

To obtain an access token for a system-assigned managed identity, code or scripts running on the VM must interact with the local Managed Identity for Azure Resources endpoint. This endpoint is a special, non-routable IP address (169.254.169.254) that the Azure fabric makes available to the VM. A request to this endpoint, typically an HTTP GET, will return an access token. Once the access token is obtained, it can then be used to authenticate requests to Azure services like Azure Resource Manager. Therefore, using PowerShell on the VM to make a request to the local managed identity endpoint is correct for obtaining the token, and then from the code on the VM, calling Azure Resource Manager using that access token is correct for utilizing it. Using a SAS token or generating a user delegation SAS token are incorrect as managed identities use OAuth 2.0 access tokens, not SAS tokens, for authentication. Using PowerShell on a remote machine is incorrect because the local managed identity endpoint is only accessible from within the VM itself.