Examkin

Question

Difficulty: MediumConfigure Microsoft Entra ID Authentication for Storage

An organization has an Azure subscription containing a resource group named rg-hr. Within rg-hr, there is an Azure Storage account named sthrdocs99 that contains a blob container named salaries. A security group named HR-Auditors must be allowed to read the blobs in the salaries container. An administrator assigns the Reader role to the HR-Auditors group at the storage account level. Members of the group report that they can view the storage account properties in the Azure portal but receive an authorization error when they attempt to list or read the blobs. What role assignment should the administrator configure to allow the HR-Auditors group to read the blobs while adhering to the principle of least privilege?

  1. Assign the Storage Blob Data Reader role to the HR-Auditors group at the scope of the salaries container.Answer
  2. B
    Assign the Contributor role to the HR-Auditors group at the scope of the sthrdocs99 storage account.
  3. C
    Assign the Directory Readers Microsoft Entra ID role to the HR-Auditors group.
  4. D
    Assign the Reader role to the HR-Auditors group at the scope of the salaries container.

Answer

Assign the Storage Blob Data Reader role to the HR-Auditors group at the scope of the salaries container.
To read blobs using Microsoft Entra ID authentication, a security principal must be assigned a data plane role such as Storage Blob Data Reader. To enforce least privilege, this role should be scoped to the specific blob container (salaries) rather than the entire storage account.

Step-by-Step Solution

1
Analyze the access requirements.
The security group requires data plane access (reading blobs) within a specific container.
This establishes that data-plane permissions are needed rather than control-plane management permissions.
2
Identify the correct role for reading blobs using Microsoft Entra ID.
The Storage Blob Data Reader role is the built-in role designed for read-only data plane access to Azure Blobs.
Standard roles like Reader or Contributor only operate on the control plane and do not grant access to blob data.
3
Apply the principle of least privilege.
Scope the Storage Blob Data Reader assignment directly to the salaries container rather than the storage account level.
This limits the scope of data access to only the necessary container, satisfying the security requirements.

Key Concept

Separation of control plane and data plane roles in Azure Storage RBAC assignments using Microsoft Entra ID.
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic