Your company has an Azure environment with a subscription named sub-logistics. The subscription contains a resource group named rg-shipping, which contains a storage account named stshippinglogs. You need to grant a user named User1 the ability to view the configuration of stshippinglogs in the Azure portal and read blob data stored in its containers. The solution must use the principle of least privilege. Which two role assignments should you configure?
- Reader role assigned at the stshippinglogs scopeCevap
- Storage Blob Data Reader role assigned at the stshippinglogs scopeCevap
- CContributor role assigned at the stshippinglogs scope
- DGlobal Administrator role assigned at the Microsoft Entra ID tenant scope
Cevap
Assign the Reader role and the Storage Blob Data Reader role, both at the stshippinglogs scope.
To satisfy the requirements using the principle of least privilege, the user needs both control plane access and data plane access. The Reader role at the storage account scope provides control plane access to view configurations. The Storage Blob Data Reader role at the storage account scope provides the necessary data plane access to read blobs. Assigning them at the storage account scope restricts access to only this specific resource.
Adım Adım Çözüm
Anahtar Kavram
Azure RBAC separates control plane management (e.g., Reader role) from data plane access (e.g., Storage Blob Data Reader role), and roles must be assigned at the narrowest scope possible to follow least privilege.