A company manages document storage in an Azure Storage account named stcorplegal. You need to allow members of a Microsoft Entra ID group named LegalAuditors to view and download blobs in a container named case-files. The auditors will navigate to the container using the Azure portal. The solution must follow the principle of least privilege.
Which two role assignments should you configure?
- Reader at the storage account scopeAnswer
- Storage Blob Data Reader at the container scopeAnswer
- CStorage Account Contributor at the storage account scope
- DStorage Blob Data Reader at the subscription scope
Answer
Assign the Reader role at the storage account scope and the Storage Blob Data Reader role at the container scope.
To view and download blobs in a specific container using the Azure portal under the principle of least privilege, two permissions are required: first, the Reader role at the storage account scope to enable resource navigation in the portal; and second, the Storage Blob Data Reader role at the container scope to provide read access only to the necessary container.
Step-by-Step Solution
Key Concept
Configuring access to Azure Storage using Microsoft Entra ID requires separate control plane permissions (for portal navigation) and data plane permissions (for actual data access) scoped to the minimum level necessary.