You have an Azure subscription with existing resources and plan to deploy several virtual machines. Assign managed identities to the virtual machines so that each VM receives only the roles it requires, following the principle of least privilege. What is the minimum number of managed identities required?

The correct answer is 2. You need at least two managed identities to adhere to the principle of least privilege. One user-assigned managed identity can be created for VMs that require a specific set of roles, for example, read access to a storage account. Another user-assigned managed identity can be created for VMs that require a different set of roles, such as write access to a different storage account or access to Key Vault secrets. This separation ensures that each VM only receives the roles it requires, rather than giving all VMs the same, potentially overly permissive, identity. Using a single managed identity for all VMs would violate the principle of least privilege if the VMs have different access requirements. System-assigned managed identities are tied to the lifecycle of a single VM, so they would not be reusable across multiple VMs with similar needs.