Examkin

Question

Difficulty: MediumManage Data Movement using AzCopy and Storage Explorer

A company is migrating a dataset from an on-premises file share to an Azure storage account named stcopydestination. You have been tasked with performing the migration. The security team has configured stcopydestination to reject all shared key authentication requests. You authenticate to Azure via the command line using azcopy login. When you run the command to copy the files to a blob container, you receive an error indicating that the request is not authorized. Your user account currently has the Owner role for the subscription. How should you resolve the authorization issue?

  1. Grant the Storage Blob Data Contributor role to your user account.Answer
  2. B
    Grant the Reader role to your user account at the storage account level.
  3. C
    Generate an account-level Shared Access Signature (SAS) token with a short expiration period and append it to the destination container URL.
  4. D
    Enable the exception for trusted Microsoft services in the storage account firewalls and virtual networks settings.

Answer

Grant the Storage Blob Data Contributor role to your user account.
The correct answer is to grant the Storage Blob Data Contributor role to your user account. When a storage account is configured to reject shared key authentication, access via account keys and standard SAS tokens is disabled. Data operations must be authorized using Microsoft Entra ID. Because the subscription Owner role only provides control-plane access, it does not grant permissions to write blob data when using Entra ID. Therefore, the Storage Blob Data Contributor role must be explicitly assigned to the user's account to allow the AzCopy upload operation.

Step-by-Step Solution

1
Identify the authentication requirement imposed by the security configuration.
Since stcopydestination rejects shared key authentication, standard access keys and account/service SAS tokens cannot be used. The copy operation must rely on Microsoft Entra ID authorization.
Disabling shared key access enforces Entra ID-based authentication for all data plane operations.
2
Evaluate the current permissions of the user account.
The user has the Owner role for the subscription, which provides full control-plane administrative access but does not grant data-plane access when using Entra ID authorization.
Azure RBAC separates control-plane roles (like Owner and Contributor) from data-plane roles (like Storage Blob Data Contributor).
3
Determine the required role for data-plane write access.
Assign the Storage Blob Data Contributor role to the user account.
This role provides the necessary data-plane permissions to read, write, and delete Azure Storage blobs via Entra ID authorization.

Key Concept

Azure Storage separates control plane and data plane RBAC roles, and disabling Shared Key access requires the use of Microsoft Entra ID roles (such as Storage Blob Data Contributor) for data operations.
Rate this question

Topics

Manage Data Movement using AzCopy and Storage Explorer

More questions from this topic