An administrator is configuring access control for an Azure Storage account named corpdata2026 that hosts a blob container named audits.
A user named Auditor1 must be able to browse to the storage account in the Azure portal and download the blobs within the audits container. The configuration must satisfy the following constraints:
- Auditor1 must authenticate using Microsoft Entra ID.
- Auditor1 must not have read access to any other containers in the storage account.
- The solution must minimize permissions to adhere to the principle of least privilege.
Which two roles should you assign to Auditor1? (Select two.)
- Reader assigned at the storage account scopeAnswer
- Storage Blob Data Reader assigned at the container scopeAnswer
- CStorage Account Contributor assigned at the storage account scope
- DStorage Blob Data Reader assigned at the storage account scope
Answer
Reader assigned at the storage account scope, and Storage Blob Data Reader assigned at the container scope.
To successfully browse and access the blobs in the Azure portal using Microsoft Entra ID authentication, two separate permissions are needed: control-plane access and data-plane access. The Reader role assigned at the storage account scope provides control-plane access, allowing the user to navigate to the storage account and list the containers within the portal. The Storage Blob Data Reader role assigned at the container scope provides data-plane access, allowing the user to read and download the blobs. Limiting the data-plane role to the container scope and the control-plane role to the storage account scope ensures the principle of least privilege is followed.
Step-by-Step Solution
Key Concept
To access blobs in the Azure portal using Entra ID authentication under least privilege, a user requires a control-plane role (Reader) at the storage account scope for portal navigation, and a data-plane role (Storage Blob Data Reader) scoped to the specific container for blob access.