AI-300 Practice Question 11: Identity Based Datastore
Microsoft Machine Learning Operations Engineer Associate (AI-300) · Test 2 · question 1 of 10
A compliance review of an Azure Machine Learning workspace requires that the workspace itself hold no storage account keys, SAS tokens, or service principal secrets, and that read access to a confidential blob container be granted to named data scientists rather than to everyone who can use the workspace. How should you register the datastore for that container?
Show answer and explanation
Answer:
With identity-based data access, Azure Machine Learning "prompts you for your Microsoft Entra token for data access authentication instead of keeping your credentials in the datastore", which "allows for data access management at the storage level and keeps credentials confidential". Microsoft names this a good fit precisely when "you're working with confidential data and need more granular data access management", and documents that the caller must have at least Storage Blob Data Reader on the storage account (option B). Authorization then lives in storage RBAC, per person.
- A is wrong because it is still credential-based authentication; the documented list of stored credentials includes storage access keys. The key is also a single blanket credential: anyone who can use the datastore reads the container, so there is no per-user granularity. - C is wrong because service principal information is explicitly one of the credential types credential-based authentication stores. Rotating the secret doesn't stop it being stored, and every job still reads the data as the one shared principal. - D is wrong because a SAS token is likewise a stored credential, and a datastore holds one credential set, not one per user. Minting per-person tokens moves access management out of storage RBAC into a token process you now have to operate.
Reference: Set up service authentication - Azure Machine Learning