Enabling Entra Auth for Storage via Security Group RBAC
Short answer
A Adding the system-assigned managed identities of VM1 and VM2 to an Entra security group and assigning the Storage Blob Data Contributor role to that group scoped to storage1 enables the required blob read/write access via Microsoft Entra authentication.
Question
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription that contains two virtual machine named VM1 and VM2 and a storage account named storage1.
An application runs on VM1 and VM2. The application is being migrated from storage account key authentication to Microsoft Entra authentication.
You review the current configuration and identify the following:
• VM1 and VM2 each have a system-assigned managed identity.
• Each application instance requests tokens by using only the local system-assigned managed identity.
• Network access to storage1 from VM1 and VM2 is allowed.
• No Azure RBAC data roles are assigned to the managed identities on storage1.
You need to enable the application on VM1 and VM2 to read and write blob data in storage1 by using Microsoft Entra authentication without changing how the application requests tokens.
Solution: You add the system-assigned managed identities of VM1 and VM2 to a Microsoft Entra security group, and assign the group the Storage Blob Data Contributor role scoped to storage1.
Key Takeaways
The main trap is believing that RBAC roles must be assigned individually to each managed identity rather than leveraging group-based assignments for scalability and simplicity.
This SC-500 question tests whether you can correctly use Microsoft Entra security groups to assign Storage Blob Data Contributor roles to system-assigned managed identities for Azure Storage access without modifying application code.
Common mistake: Selecting 'No' based on the false belief that only direct role assignments to individual managed identities are valid, ignoring the capability to grant roles to Entra security groups containing those identities.
Expert Analysis
The scenario requires enabling Microsoft Entra authentication for blob read/write operations on storage1 from VM1 and VM2, which use system-assigned managed identities. The core mechanism for authorization in Azure Storage when using Entra ID is assigning RBAC data roles (such as Storage Blob Data Contributor) to the security principal accessing the data.
The proposed solution involves adding the system-assigned managed identities of VM1 and VM2 into a Microsoft Entra security group and then assigning the Storage Blob Data Contributor role to that group at the scope of storage1. This approach is technically valid because:
- Managed identities (both system-assigned and user-assigned) can be members of Microsoft Entra security groups.
- Role assignments in Azure RBAC can be granted directly to security principals, including security groups.
- When a role is assigned to a group, all members of that group inherit the permissions associated with that role at the specified scope.
- The applications already request tokens via their local system-assigned managed identities; no code changes are needed. Once the identities have the necessary RBAC role assignment (via group membership), they will receive valid access tokens for storage operations.
A common misconception, reflected in some community comments suggesting individual assignment is the "only" valid approach, is incorrect. While assigning roles directly to each identity works, it does not scale well. Using a group is a standard best practice for managing permissions across multiple resources or identities, providing easier administration and auditability. Therefore, the solution meets the stated goals.
Exam Strategy
When evaluating solutions involving permission grants, always consider if group-based assignments are viable. Azure RBAC supports granting roles to any security principal, including Entra security groups. Using groups simplifies management and is often the preferred architectural pattern over assigning roles to many individual identities. If a solution uses a group to aggregate identities and assigns the correct role, it is typically valid unless specific constraints forbid it.
Frequently Asked Questions
Can system-assigned managed identities be added to Entra security groups?
Why not assign the Storage Blob Data Contributor role directly to each VM's identity?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
oztech 👍 1 Answered BFor System-Assigned identities, the only valid approach is to assign the Storage Blob Data Contributor role to each VM's identity individually.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →