Examkin

Question

Difficulty: EasyConfigure Microsoft Entra ID Authentication for Storage

An organization's Azure environment contains a resource group named RG-Data that hosts a storage account named storageapp2026. An administrator needs to configure permissions so that a user named Jordan can download files from a blob container named 'logs'. The configuration must use Microsoft Entra ID authentication and follow the principle of least privilege, ensuring Jordan cannot modify any data or change storage account settings. Which Azure role-based access control (RBAC) role should the administrator assign to Jordan?

  1. Storage Blob Data ReaderAnswer
  2. B
    Reader
  3. C
    Storage Account Contributor
  4. D
    User Administrator

Answer

Storage Blob Data Reader
The correct answer is the Storage Blob Data Reader role because it grants data plane access to read and list blob containers and their contents using Microsoft Entra ID authentication. This matches the requirements of downloading files under the principle of least privilege, without allowing management actions or write operations.

Step-by-Step Solution

1
Determine the type of operation needed for the user to download files from a blob container.
The operation is a data plane access request (reading blob content).
Downloading blob content requires permissions on the data plane, not just management permissions on the control plane.
2
Select the built-in Azure RBAC role that provides read-only data access to blobs while adhering to least privilege.
The Storage Blob Data Reader role is selected.
This role allows reading and listing blobs within container resources without permitting modifications or configuration changes.

Key Concept

Separation of control plane and data plane RBAC roles in Azure Storage
Estimated Time:45s
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic