Examkin

Question

Difficulty: Very hardConfigure Microsoft Entra ID Authentication for Storage

Your company has an Azure subscription containing a resource group named RG1. RG1 contains an Azure Storage account named corpstorage1 that hosts a blob container named reports. You have an Azure virtual machine named VM1 that has a system-assigned managed identity enabled. You deploy a custom application on VM1. The application must perform the following tasks:
1. Retrieve a list of blobs from the reports container.
2. Generate a User Delegation SAS token to allow temporary read access to individual reports in the container.
You need to configure the minimal role assignments to allow the application on VM1 to perform these tasks using Microsoft Entra ID authentication under the principle of least privilege. Which two role assignments should you configure?

  1. Assign the Storage Blob Delegator role to the system-assigned managed identity of VM1 at the corpstorage1 storage account scope.Answer
  2. Assign the Storage Blob Data Reader role to the system-assigned managed identity of VM1 at the reports container scope.Answer
  3. C
    Assign the Reader role to the system-assigned managed identity of VM1 at the corpstorage1 storage account scope.
  4. D
    Assign the Storage Blob Data Reader role to the system-assigned managed identity of VM1 at the RG1 resource group scope.
  5. E
    Assign the Storage Blob Data Owner role to the system-assigned managed identity of VM1 at the reports container scope.

Answer

To configure access under the principle of least privilege, you should assign the Storage Blob Delegator role to the managed identity of VM1 at the corpstorage1 storage account scope, and assign the Storage Blob Data Reader role to the managed identity of VM1 at the reports container scope.
To create a User Delegation SAS, an identity must first request a User Delegation Key from the storage account. The action to request this key is Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action, which is granted by the Storage Blob Delegator role. Because this is a storage account-level service operation, the role must be assigned at the storage account level. To read the blobs, the identity needs the Storage Blob Data Reader role, which should be assigned at the container level (reports) to limit data access to only the necessary container, satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the permission needed to generate a User Delegation SAS token.
Generating a User Delegation SAS token requires a User Delegation Key. This key is requested at the storage account level using the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action operation.
Before an identity can sign a User Delegation SAS, it must obtain a user delegation key from Azure Storage.
2
Determine the appropriate role and scope for key generation.
The Storage Blob Delegator role provides the necessary action. It must be scoped at the storage account level (corpstorage1) because the user delegation key is a service-wide resource.
Assigning the role at the container scope is insufficient since container scopes do not support generating service-wide keys.
3
Determine the minimum role and scope required to retrieve the list of blobs.
The application needs to read the blobs in the reports container. The Storage Blob Data Reader role should be assigned at the reports container scope.
This configuration adheres to the principle of least privilege by restricting data-plane access only to the target container.

Key Concept

Configuring Microsoft Entra ID authentication for Azure Storage access using role-based access control (RBAC), specifically separating the control plane (Storage Blob Delegator) and the data plane (Storage Blob Data Reader) under the principle of least privilege.
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic