How Does WebApp1 Read and Write to storage1 with Its Managed Identity?

Why the Answer Is Correct

The question fixes the authentication method: WebApp1 must use its system-assigned managed identity, so authorization has to flow through Microsoft Entra ID and Azure RBAC, and the portal surface for RBAC on a storage account is Access control (IAM). You assign the WebApp1 identity a data-plane role such as Storage Blob Data Contributor (or Storage File Data SMB Share Contributor for Azure Files) as a role assignment on storage1. As ANiMOSiTYOP explained, "access to resources in Azure is dealt with through Azure Role-Based Access Control (RBAC)", and system-assigned managed identities receive roles through the resource's IAM settings. RucasII described the exact click path, noting you "Select Add > Add role assignment" from the storage account's IAM pane to grant the App Service identity access. Because the identity is already created by enabling it on WebApp1, only the role assignment step remains, which is precisely what option C configures.

Why the Other Options Are Wrong

Data protection settings control durability and retention features such as soft delete, versioning, and immutability policies; they say nothing about who may read or write data. A shared access signature is a signed, time-bound token that authorizes the request itself rather than the app's managed identity, and it forces you to store and rotate a secret in the app, defeating the purpose of using an identity. File share settings expose share-level properties such as quotas and snapshots, not identity permissions. Access keys enable shared-key authorization, which bypasses Microsoft Entra ID entirely and again requires embedding and rotating a secret instead of using the managed identity. Only IAM role assignments delegate permissions to a service principal representing the managed identity.

Community Comment Notes

Every recorded learner selected C, and the comments consistently reason from RBAC rather than from storage keys or SAS. Wazery framed it as needing to "grant the web app the appropriate permissions on the storage1 storage account", which maps directly to a role assignment. RucasII supplied the operational walkthrough of the IAM pane, which is the same evidence an exam-taker can rely on when two options both sound like "permissions". No comment defends a SAS or access key, so the community consensus and the technical analysis agree on C. One nuance worth remembering: the role you pick must be a data-plane role, because management-plane roles alone will not let the identity read blob or file contents.

Exam Strategy

When a stem says "using the system-assigned managed identity", eliminate every option that is a key, secret, connection string, or signed token, because those represent shared-key or delegated authentication and never consume the identity. The remaining answer is a role assignment on the target resource, reached through Access control (IAM). Then sanity-check that the role you would choose is a data-plane role (Storage Blob Data Contributor) rather than a management-plane role (Contributor), since this is the most common secondary trap on SC-300 storage questions.