Does Storage Account Encryption Scope Contributor Role Allow Key Regeneration?

AZ-104 By islever Editorial Last updated Oct 5, 2026

Short answer

B Assigning the Storage Account Encryption Scope Contributor Role does not grant the permissions needed to list and regenerate storage account keys.

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Storage account named storage1. You need to enable a user named User1 to list and regenerate storage account keys for storage1. Solution: You assign the Storage Account Encryption Scope Contributor Role to User1. Does this meet the goal?

Yes
No Correct Answer

Key Takeaways

This question tests Azure RBAC roles for storage accounts, highlighting the trap of assuming a role with 'Contributor' in its name grants key management permissions.

The Storage Account Encryption Scope Contributor role does not grant permissions to list or regenerate storage account keys. This page confirms that assigning this role fails to meet the goal of enabling key management for an Azure Storage account.

Common mistake: Choosing 'Yes' because the role title contains 'Contributor,' leading to the false assumption that it includes key regeneration permissions.

Expert Analysis

Why the Answer Is Correct

The correct answer is "No" because the Storage Account Encryption Scope Contributor role is specifically designed to manage encryption scopes within a storage account. It does not include the Microsoft.Storage/storageAccounts/listKeys/action or Microsoft.Storage/storageAccounts/regenerateKey/action permissions required to list and regenerate storage account keys.

Why the Other Options Are Wrong

Selecting "Yes" incorrectly assumes that any role with "Contributor" in its name inherently possesses full management rights, including key operations. In Azure RBAC, roles are highly granular, and the Encryption Scope Contributor role is narrowly scoped to encryption management only.

Community Comment Notes

Community members correctly pointed out that the required permissions are found in the Storage Account Key Operator Service Role, as Shakka noted by listing the specific "listKeys/action" and "regenerateKey/action" actions. Dankho also highlighted that "Storage Account Key Operator Service Role" is the correct role to assign for this goal.

Official Reference

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-account-encryption-scope-contributor

This link opens the official vendor documentation in a new tab.

Exam Strategy

When evaluating Azure RBAC role assignments, never rely solely on the role's name; always verify the specific actions (permissions) it grants. For key management tasks, look for roles explicitly containing 'Key Operator' or verify the presence of listKeys and regenerateKey actions.

Community Votes

80%

20%

80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors, not of islever. The comments shown first are the most substantive of the thread — ranked by depth, community endorsement and relevance; expand the list below to read the rest.

From public community threads 9

Dankho 👍 6

The Storage Account Encryption Scope Contributor role allows a user to manage encryption scopes in a storage account but does not grant the ability to list and regenerate storage account keys. To meet the goal, you would need to assign the Storage Account Key Operator Service Role or a role with broader access such as the Storage Account Contributor role, which includes permissions to list and regenerate keys.
Shakka 👍 2 Answered B

the Storage Account Encryption Scope Contributor role does not have the permissions to list and regenerate storage account keys. These actions require specific permissions that are not included in this role. To list and regenerate storage account keys, you would need a role that includes the Microsoft.Storage/storageAccounts/listKeys/action and Microsoft.Storage/storageAccounts/regenerateKey/action permissions. Some roles that have these permissions are: Owner Contributor Storage Account Key Operator Service Role1.
Alawi1990 👍 2

The Storage Account Encryption Scope Contributor role does not grant permissions to list and regenerate storage account keys. - No
Mentalfloss 👍 2 Answered A

I wasn't sure if this was a real role so I Googled it, answer is A (Yes).
arunyadav09 👍 2 Answered B

It should be Storage Account Key Operator Service Role.

Show 4 more comments

appyapurv 👍 1

• The Storage Account Encryption Scope Contributor role provides permissions to manage encryption scopes within a storage account. However, it does not grant permissions to list or regenerate storage account keys. • To allow a user to list and regenerate storage account keys, the user should be assigned the Storage Account Key Operator Service Role or a higher role like Contributor or Storage Account Contributor. Thus, assigning the Storage Account Encryption Scope Contributor role does not meet the goal of enabling User1 to list and regenerate storage account keys.
Bravo_Dravel 👍 1 Answered B

This role allows managing encryption scopes but does not grant permissions to list and regenerate storage account keys1. To enable User1 to list and regenerate storage account keys, you should assign the Storage Account Key Operator Service Role or the Storage Account Contributor Role
alsmk2 👍 1 Answered B

SA Cont or Key operator role required.
Mentalfloss 👍 1 Answered B

Cancelling my previous A vote.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide