Examkin

Question

Difficulty: EasyManage Data Movement using AzCopy and Storage Explorer

An administrator successfully logs in to AzCopy using a Microsoft Entra ID account. However, when the administrator attempts to copy files to an Azure Blob storage container, the copy operation fails with an authorization error. The administrator's user account has the Contributor role for the storage account. Which action should the administrator perform to resolve the authorization error?

  1. Assign the Storage Blob Data Contributor role to the administrator's user account.Answer
  2. B
    Assign the Storage Queue Data Contributor role to the administrator's user account.
  3. C
    Regenerate the storage account access keys.
  4. D
    Enable the 'Allow trusted Microsoft services to access this storage account' setting on the storage account firewall.

Answer

Assign the Storage Blob Data Contributor role to the administrator's user account.
The correct answer is to assign the Storage Blob Data Contributor role. Microsoft Entra ID authorization requires specific data-plane roles for storage data access. Control plane roles like Contributor manage the storage account structure but do not allow writing or reading Blob data directly.

Step-by-Step Solution

1
Identify the authentication mechanism used in the AzCopy command.
The administrator successfully logged in with a Microsoft Entra ID account, which indicates they are using token-based authentication.
Identifying the authentication method determines whether permissions are managed via RBAC data-plane roles or storage access keys.
2
Analyze the administrator's current RBAC role assignment.
The administrator has the Contributor role at the storage account level.
Standard Azure management roles like Contributor only govern control-plane access. They do not grant default authorization to view or write blob data (data-plane).
3
Determine the required data-plane role for Blob storage operations.
The Storage Blob Data Contributor role provides data-plane access to write blobs to containers.
Assigning this role resolves the authorization error by granting the necessary data plane permissions to the Entra ID user account.

Key Concept

Data-plane versus control-plane permissions for Azure Storage using Microsoft Entra ID authentication
Estimated Time:1m 0s
Rate this question

Topics

Manage Data Movement using AzCopy and Storage Explorer

More questions from this topic