AZ-104 Certification Practice Question #139

Question

You are configuring Azure Active Directory (Azure AD) authentication for an Azure Storage account named storage1.
You need to ensure that the members of a group named Group1 can upload files by using the Azure portal. The solution must use the principle of least privilege.
Which two roles should you configure for storage1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

To allow users to upload files via the Azure portal using Entra credentials, two components are required: data plane access to perform the write/upload action and control plane access to navigate the portal to the storage account. Under the principle of least privilege, the data plane permission is provided by the **Storage Blob Data Contributor** role, and the control plane navigation permission is provided by the **Reader** role. Together, these two roles represent the minimum permission set required.

More AZ-104 practice questions