Examkin

Question

Difficulty: MediumConfigure Microsoft Entra ID Authentication for Storage

An Azure Storage account named saexports hosts a blob container named monthly-reports. A data analyst named Maria plans to use the AzCopy command-line utility to download files from the container by authenticating via Microsoft Entra ID. You need to identify the minimum Azure role-based access control (Azure RBAC) configuration that allows Maria to download the blobs. Which role assignment should you configure for Maria?

  1. A
    Configure an Azure RBAC assignment for the Reader role, scoped to the storage account, for Maria.
  2. B
    Configure an Azure RBAC assignment for the Storage Account Contributor role, scoped to the storage account, for Maria.
  3. Configure an Azure RBAC assignment for the Storage Blob Data Reader role, scoped to the container, for Maria.Answer
  4. D
    Configure a Microsoft Entra ID built-in role assignment for the User Administrator role for Maria.

Answer

Configure an Azure RBAC assignment for the Storage Blob Data Reader role, scoped to the container, for Maria.
The correct configuration is assigning the Storage Blob Data Reader role scoped to the container. This grants Maria data plane read access to the blobs inside the monthly-reports container using Microsoft Entra ID credentials without granting unnecessary write or control plane permissions.

Step-by-Step Solution

1
Determine the access plane required for the operation.
Maria needs to read blob data, which requires data plane access rather than control plane access.
Control plane roles like Reader or Storage Account Contributor manage the storage account resource itself but do not grant data plane access to read blob content when authenticating via Microsoft Entra ID.
2
Identify the least-privileged role that satisfies the data plane read requirement.
The Storage Blob Data Reader role is the least privileged built-in role that allows read-only access to blob data.
Other data plane roles like Storage Blob Data Contributor or Storage Blob Data Owner grant write or delete access, which violates the principle of least privilege.
3
Determine the correct scope for the role assignment.
Assign the role at the container scope (monthly-reports).
Scoping the assignment to the specific container restricts access only to the necessary files, adhering to the principle of least privilege.

Key Concept

Assigning least-privilege Azure RBAC data plane roles for blob storage authentication via Microsoft Entra ID.
Estimated Time:1m 30s
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic