Examkin

Question

Difficulty: MediumConfigure Microsoft Entra ID Authentication for Storage

You have an Azure subscription containing a resource group named `rg-analytics` and an Azure Storage account named `streports2026`. Inside the storage account, you have a blob container named `auditlogs`.

A team of internal auditors belongs to a Microsoft Entra ID group named `Audit-Team-Group`. The auditors need to upload and read blobs in the `auditlogs` container. They must also be able to browse to the container using the Azure Portal. The solution must follow the principle of least privilege.

To configure the required access, which of the following role assignments should you perform? (Select two.)

  1. Assign the Reader role to Audit-Team-Group at the streports2026 storage account scope.Answer
  2. Assign the Storage Blob Data Contributor role to Audit-Team-Group at the auditlogs container scope.Answer
  3. C
    Assign the Contributor role to Audit-Team-Group at the streports2026 storage account scope.
  4. D
    Assign the Directory Readers role in Microsoft Entra ID to the Audit-Team-Group.

Answer

Assign the Reader role to Audit-Team-Group at the streports2026 storage account scope, and assign the Storage Blob Data Contributor role to Audit-Team-Group at the auditlogs container scope.
To access blob data using Microsoft Entra ID authentication in the Azure Portal, security principals require both control plane access to view the storage account and data plane access to read and write the blobs. Assigning the Reader role at the storage account scope provides portal navigation capabilities, while assigning the Storage Blob Data Contributor role at the container scope provides the necessary data plane access under the principle of least privilege.

Step-by-Step Solution

1
Determine the data plane role required for reading and writing (uploading) blobs.
The Storage Blob Data Contributor role is selected at the container scope to grant read and write access to blobs while adhering to least privilege.
This role is required to perform data plane actions such as uploading and reading blobs.
2
Determine the role required to navigate the Azure Portal to the storage account.
The Reader role is selected at the storage account scope.
Users accessing storage via the Azure Portal need a control-plane role (such as Reader) at the storage account scope to locate and navigate to the resource in the portal interface.

Key Concept

Azure RBAC split between control plane and data plane for Azure Storage when using Microsoft Entra ID authentication in the Azure Portal.
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic