The correct options are Get-AzVM and Get-AzResource.

Get-AzVM returns the virtual machine resource and includes the identity properties for the VM. The system assigned managed identity appears as the Identity.PrincipalId on the VM object and that PrincipalId is the Azure AD objectId you need, so you can query or select that field for each VM with PowerShell.

Get-AzResource can also retrieve the VM resource and its properties so you can inspect the identity block and read identity.principalId there. This command is useful when you are enumerating resources and need to extract the managed identity object id from the resource properties.

az ad sp credential list is incorrect because it lists credentials for service principals and does not directly enumerate the system assigned managed identity objectId for VM resources. The az ad namespace is tied to Azure AD Graph style operations which are being replaced by Microsoft Graph for newer tooling.

Get-AzureADUser is incorrect because it returns Azure AD user objects and not managed identities attached to VMs. The AzureAD PowerShell module that provides this cmdlet is also being deprecated in favor of Microsoft Graph PowerShell so it is less likely to be the intended approach on newer exams.

az ad signed-in-user list-owned-objects is incorrect because it lists objects owned by the signed in user and will not reliably return managed identities for every VM. It is focused on user ownership rather than the VM resource identity.

Get-AzureADUserOwnedObject is incorrect because it targets objects owned by a user and not VM managed identities. This cmdlet is part of the AzureAD module which is being deprecated and so it is not the recommended method for retrieving VM identity object ids on updated platforms.

Full AWS Practitioner Certification Question