Examkin

Question

Difficulty: EasyConfigure Microsoft Entra ID Authentication for Storage

You have an Azure Storage account named storage1. You need to grant a user named User1 the ability to read blob data within the containers of storage1 by using Microsoft Entra ID authentication. Your solution must follow the principle of least privilege. Which Azure role-based access control (RBAC) role should you assign to User1?

  1. Storage Blob Data ReaderAnswer
  2. B
    Reader
  3. C
    Storage Account Contributor
  4. D
    Global Administrator

Answer

Storage Blob Data Reader
To read blob data using Microsoft Entra ID authentication, a user must be assigned a data-plane RBAC role. The Storage Blob Data Reader role provides read access to blob data and containers, satisfying the requirements while adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the data access requirements
User1 requires read-only access specifically to blob data within the storage account containers.
Determining the scope of access helps select the appropriate data-plane role.
2
Select the correct role based on the principle of least privilege
The Storage Blob Data Reader role is selected because it provides read-only access to blob data without granting control plane management capabilities.
Assigning the most restrictive built-in role that satisfies the requirement complies with security best practices.

Key Concept

Azure RBAC roles for storage data plane access
Estimated Time:45s
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic