AZ-500 Question 159
Single answerYour organization stores sensitive reports in an Azure Blob Storage container. You need to ensure that only users who are members of a specific Azure Active Directory (Azure AD) security group can read from this container, while also minimizing the overhead of managing keys or tokens. Which access method should you implement?
- A
Use a Shared Access Signature (SAS) with a user delegation key and manually redistribute it to group members
- B
Enable role-based access control (RBAC) with Azure AD so that the security group has the Reader role on the container
- C
Configure the Storage Account’s firewall to allow access only from trusted IP addresses
- D
Distribute the storage account access keys to users in the Azure AD security group
Show answer and explanation
Correct answer: B
Explanation
Using Azure RBAC integrated with Azure AD is the recommended approach for granular, minimal-overhead access control to Blob storage. By assigning roles such as Storage Blob Data Reader or Storage Blob Data Contributor to an Azure AD security group, you ensure only its members can access the container without dealing with shared keys or individual SAS tokens. Refer to official Microsoft documentation at https://docs.microsoft.com/azure/storage/blobs/authorize-access-azure-active-directory for best practices on using Azure AD with Azure Storage.
- A. Incorrect.
Option 1 is incorrect because issuing and managing SAS tokens, even with a user delegation key, increases administrative overhead. This method requires you to generate and securely distribute SAS tokens to each authorized user.
- B. Correct.
Option 2 is correct. Assigning the appropriate RBAC role in Azure AD (e.g., Storage Blob Data Reader) to the security group allows seamless control over who can read the container, and it minimizes overhead by centrally managing membership in Azure AD.
- C. Incorrect.
Option 3 is incorrect. Although you can limit access by IP address, it doesn't address user-level authorization. Anyone connecting from an allowed IP can access the container, which doesn't meet the requirement of restricting access strictly to a specific security group.
- D. Incorrect.
Option 4 is incorrect because distributing account keys is a broad approach. Anyone with the key has full access at that level, making it difficult to enforce per-user or per-group restrictions, and it creates significant security and management overhead.