AZ-104 Practice Question 81: Blob Data Plane Role
Microsoft Azure Administrator Associate (AZ-104) · Test 9 · question 1 of 10
A user has the Reader role on a storage account. Running az storage blob list with --auth- mode login fails with an authorization error. The user must read blobs with Microsoft Entra credentials and nothing more.
Which role should the administrator assign?
Show answer and explanation
Answer:
Reading blob data with Entra credentials needs a data-plane role. Storage Blob Data Reader grants read and list access to blobs and containers and no write access, which meets the least-privilege requirement. Control-plane roles such as Reader do not include data actions.
Option A grants management rights over the account, including writes, and does not include the data actions needed for login-based access.
Option C allows listing and regenerating the account keys, which would let the user bypass Entra authorization and gain full data access.
Option D lets the user manage role assignments and gives no data access.
Reference: Assign an Azure role for access to blob data