Examkin

Question

Difficulty: EasyConfigure Microsoft Entra ID Authentication for Storage

An administrator needs to configure permissions for a developer named User1 to access blob data in a storage account named devstorage99. The developer must be able to read blobs using Microsoft Entra ID authentication.

Which two built-in Azure role-based access control (RBAC) roles should the administrator assign to User1 to permit this data access? (Select two)

  1. Storage Blob Data ReaderAnswer
  2. Storage Blob Data ContributorAnswer
  3. C
    Reader
  4. D
    Storage Account Contributor

Answer

Storage Blob Data Reader and Storage Blob Data Contributor
To read blob data using Microsoft Entra ID authentication, a user must be assigned an Azure RBAC role that operates on the data plane. The Storage Blob Data Reader role allows read-only access to blobs. The Storage Blob Data Contributor role allows read, write, and delete access to blobs, which also satisfies the requirement to read blobs.

Step-by-Step Solution

1
Identify the data plane requirements for Azure Storage blob access.
The user needs to read blob data, which requires data-plane RBAC permissions.
Control-plane roles like Reader or Storage Account Contributor do not grant permissions to read or write data inside containers.
2
Evaluate the built-in Azure Storage data-plane roles.
Storage Blob Data Reader provides read-only access to blob data, and Storage Blob Data Contributor provides read and write access to blob data.
Both roles satisfy the requirement to read blob data using Microsoft Entra ID authentication.

Key Concept

Azure RBAC Control Plane vs Data Plane for Storage Accounts
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic