Examkin

Question

Difficulty: Very hardConfigure Microsoft Entra ID Authentication for Storage

An administrator is configuring security for an Azure Storage account named storage1 to comply with a corporate security policy. The policy dictates that all access keys must be disabled, and shared key access must be blocked. The administrator sets the allowSharedKeyAccess property to false on storage1. A developer named User1 is assigned the Storage Blob Data Reader role scoped to a container named archive in storage1. User1 needs to generate a Shared Access Signature (SAS) token that allows an external application to read blobs from the archive container. The external application cannot authenticate using Microsoft Entra ID. User1 attempts to generate a SAS token, but the token is rejected by the storage account. You need to configure the resource permissions to ensure that User1 can successfully generate a functional SAS token to access the container while maintaining the principle of least privilege. Which action should you perform?

  1. Assign User1 the Storage Blob Delegator role at the storage account level, and have User1 generate a User Delegation SAS.Answer
  2. B
    Assign User1 the Storage Account Contributor role at the resource group level, and have User1 generate an account SAS.
  3. C
    Assign User1 the Reader role at the subscription level, and have User1 generate a service SAS.
  4. D
    Assign User1 the Storage Blob Data Reader role at the storage account level, and have User1 generate a User Delegation SAS.

Answer

Assign User1 the Storage Blob Delegator role at the storage account level, and have User1 generate a User Delegation SAS.
Assigning the Storage Blob Delegator role at the storage account level provides the 'Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action' permission. Since shared key access is disabled, standard SAS tokens are blocked. A User Delegation SAS, which is signed using Microsoft Entra ID credentials, must be used instead. Scoping the Storage Blob Data Reader role to the container ensures that the user has data access only to the necessary container, conforming to the principle of least privilege.

Step-by-Step Solution

1
Identify the impact of disabling shared key access on Azure Storage.
Setting allowSharedKeyAccess to false blocks all SAS tokens signed with account access keys (Service and Account SAS).
The storage account enforces Microsoft Entra ID authorization and rejects shared key authentication.
2
Select the correct SAS type to bypass the shared key restriction.
A User Delegation SAS must be used because it is signed using Microsoft Entra ID credentials rather than the account access key.
This satisfies the requirement to authenticate using Microsoft Entra ID while allowSharedKeyAccess is false.
3
Identify the required permissions for generating a User Delegation SAS.
The user needs the 'Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action' permission, which is granted by the Storage Blob Delegator role.
This action is required to request the user delegation key from the storage account to sign the SAS token.
4
Apply the principle of least privilege for the final assignment.
Assign the Storage Blob Delegator role at the storage account scope (since it is a service-level action) and keep the Storage Blob Data Reader role at the container scope.
This grants the minimum necessary privileges required for both key delegation and data reading without giving write/delete access.

Key Concept

Enforcing Microsoft Entra ID authentication for Azure Storage by disabling shared key access and using the Storage Blob Delegator role to generate User Delegation SAS tokens.
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic