Examkin

Question

Difficulty: HardManage Data Movement using AzCopy and Storage Explorer

An enterprise migration plan requires transferring virtual machine image files from an on-premises Windows server to an Azure storage account named stmigrationprod. The target destination is a private blob container named images.

The storage account network configuration is set to 'Enabled from selected virtual networks and IP addresses'. No virtual network or firewall IP rules are currently configured.

An administrator logs in to AzCopy using Microsoft Entra ID credentials that have been assigned the User Access Administrator and Contributor roles for the subscription containing the storage account.

When running the azcopy copy command, the administrator receives a 403 Forbidden error.

Which of the following configuration changes must the administrator perform to resolve this error and complete the file transfer? (Select TWO.)

  1. Add the public IP address of the local Windows server to the firewall settings of the storage account.Answer
  2. Assign the Storage Blob Data Contributor role to the administrator's Microsoft Entra ID account.Answer
  3. C
    Assign the Reader role to the administrator's Microsoft Entra ID account at the storage account level.
  4. D
    Enable the 'Allow trusted Microsoft services to access this storage account' setting on the storage account firewall.

Answer

To resolve the 403 Forbidden error during the AzCopy data movement, the administrator must add the local Windows server's public IP address to the storage account firewall settings and assign the Storage Blob Data Contributor role to their Microsoft Entra ID account.
To successfully transfer data using AzCopy with Microsoft Entra ID authentication to a secured storage account, two conditions must be met: network access and data-plane authorization. First, since the storage account's firewall is restricted to selected networks, the on-premises client's public IP address must be added to the allowed IP ranges. Second, because control plane roles (like Contributor or Owner) do not inherit data-plane permissions, the administrator must be assigned a data-plane role such as Storage Blob Data Contributor.

Step-by-Step Solution

1
Configure the storage account network firewall rules.
The public IP address of the Windows server is added to the allowed IP ranges of the storage account.
Since the firewall is restricted to selected networks, the on-premises client cannot initiate a connection unless its IP address is explicitly permitted.
2
Assign the appropriate data-plane role in Microsoft Entra ID.
The Storage Blob Data Contributor role is assigned to the administrator's account.
Standard Azure RBAC roles like Contributor or Owner only manage the control plane and do not grant data plane read/write permissions for blobs.

Key Concept

Successful data transfer using AzCopy with Microsoft Entra ID authentication requires both network firewall exceptions for the client's public IP and data-plane specific RBAC permissions (such as Storage Blob Data Contributor).
Rate this question

Topics

Manage Data Movement using AzCopy and Storage Explorer

More questions from this topic