Examkin

Question

Difficulty: MediumManage Data Movement using AzCopy and Storage Explorer

An administrator needs to copy a local folder from an on-premises workstation to an Azure Storage account named `stdata2026`. The storage account firewall is configured to allow access only from 'Selected networks', and the administrator's public IP address has been added to the allowed firewall rules. The administrator runs `azcopy login` to authenticate using a Microsoft Entra ID user account that has the Owner role on the storage account. When attempting to run `azcopy copy`, the operation fails with a '403 Authorization Failed' error.

What is the most likely cause of this failure?

  1. A
    The storage account firewall does not have the 'Allow trusted Microsoft services to access this storage account' bypass option enabled.
  2. B
    The user account must be assigned the Microsoft Entra ID Global Administrator role to perform data operations in Azure Storage.
  3. The user account is not assigned the Storage Blob Data Contributor role on the storage account.Answer
  4. D
    The Microsoft Entra ID authentication token used by AzCopy has expired due to a default Shared Access Signature (SAS) token lifetime restriction of 60 minutes.

Answer

The user account is not assigned the Storage Blob Data Contributor role on the storage account.
Azure RBAC distinguishes between control plane operations (such as managing storage accounts) and data plane operations (such as reading or writing blobs). Even with the Owner or Contributor role at the resource scope, a user cannot read or write blob data using Microsoft Entra ID authentication without being explicitly assigned a data-plane role like Storage Blob Data Contributor.

Step-by-Step Solution

1
Verify that network access from the workstation is allowed by checking the storage account firewall configuration.
Workstation public IP is allowed under 'Selected networks', confirming the issue is not network-level blocking.
Ensure the connection request reaches the storage service endpoints.
2
Analyze the active role assignments for the user account in Azure RBAC.
The user holds the Owner role, which grants full control plane access but does not inherit data plane rights.
Determine if the user's role includes data plane permissions.
3
Identify the missing data-plane role assignment needed for writing blobs.
The Storage Blob Data Contributor role must be assigned to grant the necessary write permissions for data movement.
Resolve the 403 Authorization Failed error by granting appropriate data-plane access.

Key Concept

Azure RBAC Control Plane vs Data Plane Separation
Rate this question

Topics

Manage Data Movement using AzCopy and Storage Explorer

More questions from this topic