Your company has an Azure subscription containing a resource group named rg-ops. Inside rg-ops, you have an Azure Storage account named stopslogs that contains a blob container named system-logs. You need to configure access for a Microsoft Entra ID group named OpsEngineers. The members of OpsEngineers must be able to read, write, and delete blobs inside the system-logs container, and use the Azure portal to navigate to the stopslogs storage account to view the containers. The solution must use Microsoft Entra ID credentials and follow the principle of least privilege. Which of the following role assignments should you configure? (Select two.)
- Assign the Storage Blob Data Contributor role to OpsEngineers scoped to the system-logs container.Answer
- Assign the Reader role to OpsEngineers scoped to the stopslogs storage account.Answer
- CAssign the Contributor role to OpsEngineers scoped to the stopslogs storage account.
- DAssign the Storage Blob Data Reader role to OpsEngineers scoped to the system-logs container.
Answer
Assign the Storage Blob Data Contributor role scoped to the system-logs container, and assign the Reader role scoped to the stopslogs storage account.
To satisfy the requirements using the principle of least privilege, two roles are needed: a data-plane role and a control-plane role. Assigning the Storage Blob Data Contributor role scoped to the system-logs container provides the necessary read, write, and delete permissions for the blob data. Assigning the Reader role scoped to the stopslogs storage account provides the control-plane permissions required to navigate the Azure portal and view the storage account and its containers without granting excessive administrative permissions or access keys.
Step-by-Step Solution
Key Concept
Azure RBAC separates control-plane management from data-plane access for Azure Storage.