Resource Reader permits configuration inspection but not private blob data retrieval. In this case, a contractor can read every container because the role was assigned at account scope. “Management-plane Reader does not grant Blob data-plane read access” would not satisfy that requirement; the supported action is “Reassign the data role to the required container and remove broad grants”. Role scope determines inherited blob data permissions.

Portal management views can depend on Azure Resource Manager read permissions separately from data access. In this case, a contractor can read every container because the role was assigned at account scope. “A management-plane Reader assignment for the storage resource” would not satisfy that requirement; the supported action is “Reassign the data role to the required container and remove broad grants”. Role scope determines inherited blob data permissions.

Disabling Shared Key blocks applicable shared-key based blob/queue authorization and favors Entra-based access. In this case, a contractor can read every container because the role was assigned at account scope. “Disable Shared Key authorization on a supported storage account” would not satisfy that requirement; the supported action is “Reassign the data role to the required container and remove broad grants”. Role scope determines inherited blob data permissions.

Sharing the account key permits broad signing and storage access, far beyond the client’s limited upload requirement. The competing choice “Give the client the account key so it can create unrestricted service SAS tokens” does not meet the specific requirement: A storage uploader must grant a short-lived Blob upload permission to a client without sharing the storage account key. Which SAS signing approach supports Microsoft Entra authorization. The supported action is “Use a user delegation SAS signed with a user delegation key derived from Microsoft Entra authorization”.

A user delegation key depends on appropriate Microsoft Entra authorization; removing all such roles would prevent the intended controlled signing process. The competing choice “Disable all storage RBAC roles and assume the SAS grants Entra permissions automatically” does not meet the specific requirement: A storage uploader must grant a short-lived Blob upload permission to a client without sharing the storage account key. Which SAS signing approach supports Microsoft Entra authorization. The supported action is “Use a user delegation SAS signed with a user delegation key derived from Microsoft Entra authorization”.

Publishing an account key creates a critical credential exposure and does not enforce a brief scoped upload grant. The competing choice “Publish the storage account shared key in a public application configuration” does not meet the specific requirement: A storage uploader must grant a short-lived Blob upload permission to a client without sharing the storage account key. Which SAS signing approach supports Microsoft Entra authorization. The supported action is “Use a user delegation SAS signed with a user delegation key derived from Microsoft Entra authorization”.

RBAC cannot override network filtering for the storage service. In this case, an old application fails after shared key authorization is disabled. “Storage firewall and private networking configuration” would not satisfy that requirement; the supported action is “Migrate the application to supported Entra or authorized delegation methods”. Applications using account keys may need their authentication model updated.

A managed identity has no automatic data access to storage just because it exists. In this case, an old application fails after shared key authorization is disabled. “Grant the identity an appropriate blob data role” would not satisfy that requirement; the supported action is “Migrate the application to supported Entra or authorized delegation methods”. Applications using account keys may need their authentication model updated.

Role scope determines inherited blob data permissions. In this case, an old application fails after shared key authorization is disabled. “Reassign the data role to the required container and remove broad grants” would not satisfy that requirement; the supported action is “Migrate the application to supported Entra or authorized delegation methods”. Applications using account keys may need their authentication model updated.

A control-plane role is not sufficient for private blob-content writes. In this case, a storage transfer tool must access a private blob via its managed identity. “Azure RBAC resource Contributor is different from blob data operations” would not satisfy that requirement; the supported action is “Grant the identity an appropriate blob data role”. A managed identity has no automatic data access to storage just because it exists.

Built-in Blob Data Contributor can include delete; least privilege may need a custom role or limited SAS. In this case, a storage transfer tool must access a private blob via its managed identity. “A scoped custom data role or narrowly constrained supported delegation” would not satisfy that requirement; the supported action is “Grant the identity an appropriate blob data role”. A managed identity has no automatic data access to storage just because it exists.

Disabling Shared Key blocks applicable shared-key based blob/queue authorization and favors Entra-based access. In this case, a storage transfer tool must access a private blob via its managed identity. “Disable Shared Key authorization on a supported storage account” would not satisfy that requirement; the supported action is “Grant the identity an appropriate blob data role”. A managed identity has no automatic data access to storage just because it exists.

Built-in Blob Data Contributor can include delete; least privilege may need a custom role or limited SAS. In this case, an access failure persists despite the data role being correct. “A scoped custom data role or narrowly constrained supported delegation” would not satisfy that requirement; the supported action is “Storage firewall and private networking configuration”. RBAC cannot override network filtering for the storage service.

Disabling Shared Key blocks applicable shared-key based blob/queue authorization and favors Entra-based access. In this case, an access failure persists despite the data role being correct. “Disable Shared Key authorization on a supported storage account” would not satisfy that requirement; the supported action is “Storage firewall and private networking configuration”. RBAC cannot override network filtering for the storage service.

A control-plane role is not sufficient for private blob-content writes. In this case, an access failure persists despite the data role being correct. “Azure RBAC resource Contributor is different from blob data operations” would not satisfy that requirement; the supported action is “Storage firewall and private networking configuration”. RBAC cannot override network filtering for the storage service.

RBAC cannot override network filtering for the storage service. In this case, a user needs to upload but not delete blobs in a staging container. “Storage firewall and private networking configuration” would not satisfy that requirement; the supported action is “A scoped custom data role or narrowly constrained supported delegation”. Built-in Blob Data Contributor can include delete; least privilege may need a custom role or limited SAS.

A managed identity has no automatic data access to storage just because it exists. In this case, a user needs to upload but not delete blobs in a staging container. “Grant the identity an appropriate blob data role” would not satisfy that requirement; the supported action is “A scoped custom data role or narrowly constrained supported delegation”. Built-in Blob Data Contributor can include delete; least privilege may need a custom role or limited SAS.

A file endpoint does not automatically make the blob endpoint private. In this case, a user needs to upload but not delete blobs in a staging container. “Separate private endpoints and DNS mappings can be required per storage subresource” would not satisfy that requirement; the supported action is “A scoped custom data role or narrowly constrained supported delegation”. Built-in Blob Data Contributor can include delete; least privilege may need a custom role or limited SAS.

A managed identity has no automatic data access to storage just because it exists. In this case, an operations lead expects Contributor at resource-group scope to authorize all blob uploads. “Grant the identity an appropriate blob data role” would not satisfy that requirement; the supported action is “Azure RBAC resource Contributor is different from blob data operations”. A control-plane role is not sufficient for private blob-content writes.

DNS must map the storage host to the private endpoint within the client network. In this case, an operations lead expects Contributor at resource-group scope to authorize all blob uploads. “Private DNS zone linkage and the blob endpoint A record” would not satisfy that requirement; the supported action is “Azure RBAC resource Contributor is different from blob data operations”. A control-plane role is not sufficient for private blob-content writes.

A file endpoint does not automatically make the blob endpoint private. In this case, an operations lead expects Contributor at resource-group scope to authorize all blob uploads. “Separate private endpoints and DNS mappings can be required per storage subresource” would not satisfy that requirement; the supported action is “Azure RBAC resource Contributor is different from blob data operations”. A control-plane role is not sufficient for private blob-content writes.

A control-plane role is not sufficient for private blob-content writes. In this case, an application behind an Azure Storage private endpoint cannot reach the blob endpoint by name. “Azure RBAC resource Contributor is different from blob data operations” would not satisfy that requirement; the supported action is “Private DNS zone linkage and the blob endpoint A record”. DNS must map the storage host to the private endpoint within the client network.

The SAS resource and permission scope must include the actual intended operation. In this case, an application behind an Azure Storage private endpoint cannot reach the blob endpoint by name. “Blob-scoped SAS does not provide container listing authority” would not satisfy that requirement; the supported action is “Private DNS zone linkage and the blob endpoint A record”. DNS must map the storage host to the private endpoint within the client network.

Listing containers and reading one blob are different SAS resource types and privileges. In this case, an application behind an Azure Storage private endpoint cannot reach the blob endpoint by name. “Choose resource scope and permissions compatible with the requested operation” would not satisfy that requirement; the supported action is “Private DNS zone linkage and the blob endpoint A record”. DNS must map the storage host to the private endpoint within the client network.

The SAS resource and permission scope must include the actual intended operation. In this case, a team creates a file-service private endpoint but blob queries remain public. “Blob-scoped SAS does not provide container listing authority” would not satisfy that requirement; the supported action is “Separate private endpoints and DNS mappings can be required per storage subresource”. A file endpoint does not automatically make the blob endpoint private.

A control-plane role is not sufficient for private blob-content writes. In this case, a team creates a file-service private endpoint but blob queries remain public. “Azure RBAC resource Contributor is different from blob data operations” would not satisfy that requirement; the supported action is “Separate private endpoints and DNS mappings can be required per storage subresource”. A file endpoint does not automatically make the blob endpoint private.

Listing containers and reading one blob are different SAS resource types and privileges. In this case, a team creates a file-service private endpoint but blob queries remain public. “Choose resource scope and permissions compatible with the requested operation” would not satisfy that requirement; the supported action is “Separate private endpoints and DNS mappings can be required per storage subresource”. A file endpoint does not automatically make the blob endpoint private.

A file endpoint does not automatically make the blob endpoint private. In this case, a partner requests an SAS valid for a single object but needs list operations. “Separate private endpoints and DNS mappings can be required per storage subresource” would not satisfy that requirement; the supported action is “Choose resource scope and permissions compatible with the requested operation”. Listing containers and reading one blob are different SAS resource types and privileges.

DNS must map the storage host to the private endpoint within the client network. In this case, a partner requests an SAS valid for a single object but needs list operations. “Private DNS zone linkage and the blob endpoint A record” would not satisfy that requirement; the supported action is “Choose resource scope and permissions compatible with the requested operation”. Listing containers and reading one blob are different SAS resource types and privileges.

A control-plane role is not sufficient for private blob-content writes. In this case, a partner requests an SAS valid for a single object but needs list operations. “Azure RBAC resource Contributor is different from blob data operations” would not satisfy that requirement; the supported action is “Choose resource scope and permissions compatible with the requested operation”. Listing containers and reading one blob are different SAS resource types and privileges.

DNS must map the storage host to the private endpoint within the client network. In this case, a SAS for a blob returns unauthorized when used to list an entire container. “Private DNS zone linkage and the blob endpoint A record” would not satisfy that requirement; the supported action is “Blob-scoped SAS does not provide container listing authority”. The SAS resource and permission scope must include the actual intended operation.

A file endpoint does not automatically make the blob endpoint private. In this case, a SAS for a blob returns unauthorized when used to list an entire container. “Separate private endpoints and DNS mappings can be required per storage subresource” would not satisfy that requirement; the supported action is “Blob-scoped SAS does not provide container listing authority”. The SAS resource and permission scope must include the actual intended operation.

Built-in Blob Data Contributor can include delete; least privilege may need a custom role or limited SAS. In this case, a SAS for a blob returns unauthorized when used to list an entire container. “A scoped custom data role or narrowly constrained supported delegation” would not satisfy that requirement; the supported action is “Blob-scoped SAS does not provide container listing authority”. The SAS resource and permission scope must include the actual intended operation.