Your organization manages an Azure Storage account named stdeployments that contains a blob container named software-builds. A developer named Dev1 is currently assigned the Reader role for the resource group that contains stdeployments. Dev1 needs to download software builds from the software-builds container using Microsoft Entra ID credentials. When Dev1 attempts to access the container in the Azure portal, they receive an authorization error. You need to resolve the authorization error. The solution must follow the principle of least privilege. Which action should you perform?
- Assign the built-in Storage Blob Data Reader role to Dev1 at the scope of the software-builds containerAnswer
- BAssign the built-in Reader role to Dev1 at the scope of the software-builds container
- CAssign the built-in Contributor role to Dev1 at the scope of the stdeployments storage account
- DAssign the Global Reader directory role to Dev1 in Microsoft Entra ID
Answer
Assign the built-in Storage Blob Data Reader role to Dev1 at the scope of the software-builds container
The correct answer is to assign the built-in Storage Blob Data Reader role to Dev1 at the container scope. This provides Dev1 with the necessary data-plane permissions to read and download blobs in the container using Microsoft Entra ID. Scoping the assignment to the specific container ensures compliance with the principle of least privilege. The user's existing Reader role at the resource group level provides the necessary control-plane access to navigate to the storage account in the Azure portal, but it must be supplemented with a data-plane role for actual content access.
Step-by-Step Solution
Key Concept
Azure Storage data-plane authorization requires data-plane RBAC roles (such as Storage Blob Data Reader) which are distinct from control-plane roles (such as Reader or Contributor).