Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

You have an Azure Storage account named `devstore2026` that contains a blob container named `project-templates`.

An administrator named Admin1 must generate a User Delegation Shared Access Signature (SAS) token for an external developer. The developer requires read-only access to read and list blobs in the container. The SAS token must be valid for 12 hours.

You need to assign the minimum required Azure Role-Based Access Control (RBAC) roles to Admin1 to enable them to generate the User Delegation SAS token.

Which two roles should you assign to Admin1? (Select two.)

  1. Storage Blob DelegatorAnswer
  2. Storage Blob Data ReaderAnswer
  3. C
    Storage Account Contributor
  4. D
    Reader

Answer

To generate a User Delegation SAS, Admin1 needs the Storage Blob Delegator role to obtain the user delegation key, and the Storage Blob Data Reader role to read and list the blob data.
To create a User Delegation SAS, the identity generating the SAS must first request a user delegation key from Microsoft Entra ID. The Storage Blob Delegator role grants the action required to generate this key. Additionally, because the SAS permissions are verified against the generator's Entra ID account, the generator must also have the data plane access they are delegation-granting. Thus, the Storage Blob Data Reader role is required to grant read and list access to the blobs.

Step-by-Step Solution

1
Identify the key-signing requirements for a User Delegation SAS.
A User Delegation SAS requires obtaining a user delegation key from Microsoft Entra ID.
The creator must have the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action permission, which is provided by the Storage Blob Delegator role.
2
Determine the data plane permissions required for reading and listing blobs in the container.
The creator needs the Storage Blob Data Reader role at a minimum.
Since the User Delegation SAS is evaluated against the creator's Entra ID identity at runtime, the creator must possess at least the permissions granted by the SAS token.

Key Concept

Generating a User Delegation SAS requires both the Storage Blob Delegator role (for control plane delegation) and appropriate data plane roles (like Storage Blob Data Reader) since permissions are bounded by the creator's identity.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic