Examkin

Question

Difficulty: MediumConfigure Microsoft Entra ID Authentication for Storage

An administrator is configuring access to an Azure Storage account named auditstore77 that contains a blob container named archives. A group of external auditors named AuditTeam must be able to navigate the Azure portal to find the storage account and download the blobs within the container. The auditors will authenticate using Microsoft Entra ID. You need to assign Azure Role-Based Access Control (RBAC) roles to AuditTeam to meet the requirements using the principle of least privilege. Which two roles should you assign? (Select two.)

  1. Storage Blob Data ReaderAnswer
  2. ReaderAnswer
  3. C
    Storage Account Contributor
  4. D
    Storage Blob Data Owner

Answer

Assign the Reader and Storage Blob Data Reader roles to the AuditTeam group.
To fulfill the requirements with least privilege, two roles are needed: one for the control plane to navigate the Azure portal and one for the data plane to access the blobs. The Reader role allows the AuditTeam to view the storage account in the portal without modifying it. The Storage Blob Data Reader role provides the necessary read-only permissions to download blobs from the container using Microsoft Entra ID authentication.

Step-by-Step Solution

1
Identify the data plane access requirement.
The AuditTeam needs to download blobs. This requires read permissions to the data within the blob container.
Data plane access is managed separately from control plane operations using specific data roles.
2
Select the appropriate data plane role.
The Storage Blob Data Reader role is selected.
This role provides read-only access to blob containers and data, adhering to the principle of least privilege.
3
Identify the portal navigation requirement.
The AuditTeam needs to locate the storage account using the Azure portal.
Without a control plane role, users cannot see the storage account resource in the portal interface even if they have data plane permissions.
4
Select the appropriate control plane role.
The Reader role is selected.
The Reader role allows users to view resources in the portal without granting modification rights, satisfying the portal navigation requirement with least privilege.

Key Concept

Separation of control plane and data plane RBAC roles for Azure Storage authentication with Microsoft Entra ID.
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic