Examkin

Question

Difficulty: HardConfigure Microsoft Entra ID Authentication for Storage

You have an Azure subscription that contains a storage account named sadata2026. The storage account contains a blob container named reports. A user named User1 is assigned the following Azure role-based access control (RBAC) roles:

* Reader at the storage account scope
* Storage Blob Data Reader at the reports container scope

User1 logs into the Azure Portal, navigates to the reports container, and attempts to view the list of blobs. User1 receives an error indicating that they are not authorized to list the blobs. You need to ensure that User1 can view and download the blobs in the container using the least privilege.

Which action should you instruct User1 to perform?

  1. Switch the authentication method in the Azure Portal to Azure AD User Account.Answer
  2. B
    Assign the Storage Account Contributor role to User1 at the storage account scope.
  3. C
    Assign the Directory Reader role to User1 in Microsoft Entra ID.
  4. D
    Assign the Reader role to User1 at the Azure subscription scope.

Answer

Instruct User1 to switch the authentication method in the Azure Portal to Azure AD User Account.
The correct action is to instruct User1 to switch the authentication method in the Azure Portal to Azure AD User Account. The Reader role at the storage account level does not grant permission to view the storage account's access keys. Because the Azure Portal defaults to using access keys to list blob containers and blobs, User1 receives an authorization error. By switching the authentication method to Azure AD User Account, the portal uses Microsoft Entra ID authentication, allowing User1 to successfully list and view the blobs using their Storage Blob Data Reader role assignment.

Step-by-Step Solution

1
Analyze the existing role assignments for User1.
User1 has control plane read access (Reader) at the storage account level and data plane read access (Storage Blob Data Reader) at the container level.
This establishes that User1 has the necessary permissions to read the blobs via Entra ID but lacks permissions to list access keys.
2
Identify the cause of the authorization error in the Azure Portal.
The Azure Portal defaults to Access Key authentication when browsing containers.
Because User1 only has the Reader role at the storage account scope, they cannot retrieve the access keys, resulting in an authorization failure.
3
Determine the least-privileged resolution.
Switching the portal's authentication method to Azure AD User Account leverages User1's existing Storage Blob Data Reader permission.
This uses Entra ID authentication directly and avoids granting excessive permissions such as Storage Account Contributor.

Key Concept

Azure Storage authenticates data plane requests using either Access Keys (control plane permission required) or Microsoft Entra ID (data plane RBAC roles required). The Azure Portal defaults to Access Keys, which requires switching the authentication method for users who only have Entra ID data plane permissions.
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic