AZ-500 Question 150
Single answerYour organization uses an Azure Storage account for internal file distribution. You need to ensure that only members of a specific Azure AD group (named 'DataReaders') can read data from a particular blob container. Additionally, you must prevent any other users or groups, including those with broader subscription-level read access, from accessing the container. Which solution should you implement to achieve this requirement?
- A
Assign the Storage Blob Data Reader role to the DataReaders group at the container scope in the storage account’s Access Control (IAM) blade.
- B
Generate a user delegation SAS for each member of the DataReaders group and distribute these SAS tokens individually.
- C
Enable anonymous public read access on the container and use the storage firewall to grant the DataReaders group network access.
- D
Assign the Owner role to the DataReaders group at the subscription level, ensuring it inherits to all storage accounts.
Show answer and explanation
Correct answer: A
Explanation
In Azure, the recommended approach to control access to storage containers is to use Azure Role-Based Access Control (RBAC). Assigning the built-in Storage Blob Data Reader role at the container scope ensures only authorized users in the specified Azure AD group have read permissions. This method respects least privilege and avoids over-provisioning access. For more information, refer to the official documentation at https://learn.microsoft.com/azure/storage/blobs/authorize-access-azure-active-directory.
- A. Correct.
Correct. Assigning the built-in Storage Blob Data Reader role to the Azure AD group at the container scope ensures that only members of the DataReaders group can read the blobs. This approach enforces least privilege by granting read access to the specific container without opening more permissions across the account or subscription.
- B. Incorrect.
Incorrect. While user delegation SAS tokens can grant time-bound access, distributing individual SAS tokens to each group member is more complex to manage and does not leverage role-based access control. It also poses a higher risk of credential sharing or leakage.
- C. Incorrect.
Incorrect. Enabling anonymous public read access bypasses authentication and authorization, making the container accessible to anyone with the URL. A storage firewall alone does not authenticate Azure AD users and is insufficient for granular role-based controls.
- D. Incorrect.
Incorrect. Assigning the Owner role at the subscription level grants full administrative rights, far exceeding read access and violating the principle of least privilege. It also applies to all resources within the subscription, not just the specific container.