Examkin

Question

Difficulty: EasyConfigure Microsoft Entra ID Authentication for Storage

You are configuring security for an application that must retrieve log files from a blob container within an Azure Storage account named applogs. The application service principal requires read access to the logs using Microsoft Entra ID authentication, but must not be allowed to modify the blobs or manage the storage account metadata. Which built-in Azure role-based access control (RBAC) role is the most appropriate to assign to the service principal?

  1. A
    Reader
  2. B
    Global Reader
  3. Storage Blob Data ReaderAnswer
  4. D
    Storage Account Contributor

Answer

Storage Blob Data Reader
The correct role is Storage Blob Data Reader because it grants read-only data plane access to Azure Blob storage containers, allowing the service principal to authenticate via Microsoft Entra ID and retrieve log files without modifying data or settings.

Step-by-Step Solution

1
Identify the data plane access requirement.
The application needs to read actual blob data inside the container rather than just managing storage account configuration settings (control plane).
This establishes that a data-plane RBAC role is required instead of a standard control-plane role.
2
Determine the principle of least privilege.
The application only requires read access (not write or delete) and should not manage the storage account itself.
This rules out Contributor or Owner variants of data-plane roles.
3
Select the appropriate built-in Azure RBAC role.
The Storage Blob Data Reader role provides read-only access to blob data via Microsoft Entra ID authentication.
It matches all requirements of the scenario under the principle of least privilege.

Key Concept

Separation of control plane and data plane permissions for Azure Storage using Microsoft Entra ID authentication
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic