AZ-104 Certification Practice Question #79

Question

You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1.
The subscription is linked to a hybrid Azure Active Directory (Azure AD) tenant that contains a security group named Group1.
You need to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1.
What should you do first?

Accepted Answer

To use identity-based access control (such as assigning the Storage File Data SMB Share Elevated Contributor RBAC role) to secure access to Azure file shares over SMB, you must first enable and configure an identity source for the storage account (e.g. AD DS, Microsoft Entra Domain Services, or Microsoft Entra ID Kerberos). Enabling Active Directory authentication on the storage account registers it with the domain, which is a hard prerequisite before share-level Azure RBAC roles can be evaluated for users/groups.

More AZ-104 practice questions