Your company has an Azure subscription containing a storage account named storagedata2026. The storage account contains a blob container named receipts.
You need to grant a Microsoft Entra ID group named SalesGroup the ability to read the blobs in the receipts container by using the Azure portal. The solution must use Microsoft Entra ID credentials for authentication and must follow the principle of least privilege.
Which two role assignments are required to achieve this goal? (Select two.)
- Assign the Storage Blob Data Reader role to SalesGroup scoped to the receipts container.Cevap
- Assign the Reader role to SalesGroup scoped to the storagedata2026 storage account.Cevap
- CAssign the Storage Account Contributor role to SalesGroup scoped to the storagedata2026 storage account.
- DAssign the Directory Readers role to SalesGroup in Microsoft Entra ID.
Cevap
Assigning the Storage Blob Data Reader role to SalesGroup scoped to the receipts container and the Reader role to SalesGroup scoped to the storagedata2026 storage account.
To access the blobs in the container via the Azure portal using Microsoft Entra ID authentication, two roles are required. First, the group requires a data plane role, specifically Storage Blob Data Reader, which must be scoped to the receipts container to comply with the principle of least privilege. Second, to navigate the Azure portal interface to locate the storage account and container, the group requires the control plane Reader role scoped to the storage account.
Adım Adım Çözüm
Anahtar Kavram
To access storage account blob data using Microsoft Entra ID in the Azure portal, a user requires a data plane role (e.g., Storage Blob Data Reader) for data access and a control plane role (e.g., Reader) at the storage account scope (or higher) to navigate the portal interface.