How Should App1 Access Azure Files Without Storage Account Keys?

SC-500 By islever Editorial Last updated

Secure access to resources by using Microsoft Entra ID Implement security for storage accounts

Short answer

D Assign Storage File Data Privileged Reader to App1's managed identity so it can access Azure Files without storage account keys.

Question

You have an Azure Storage account named storage1 that contains Azure Files shares.
You have an application named App1 that uses a system-assigned managed identity to access the shares.
Administrators access the shares by using storage account keys.
You need to ensure that App1 access the shares without using the storage account keys.
What should you do on storage1?
  1. Store the storage account access keys in Azure Key Vault and regenerate them periodically.
  2. Set Allow storage account key access to Disabled.
  3. Select Default to Microsoft Entra authorization in the Azure portal.
  4. Assign the Storage File Data Privileged Reader role to the managed identity of App1. Correct Answer

Key Takeaways

This question tests the difference between authenticating with a managed identity and authorizing that identity on Azure Files; the trap is disabling shared key access and breaking administrators who still use storage account keys.

Azure Files data-plane access for a managed identity is granted through an Azure RBAC role assignment, not by disabling shared key access. The page confirms that assigning Storage File Data Privileged Reader to App1's system-assigned identity lets it authenticate without storage account keys while admins keep key-based access.

Common mistake: Many candidates choose B and disable shared key access, but that blocks the administrators who still need storage account keys and does not by itself grant App1 data-plane permissions.

Expert Analysis

Why the Answer Is Correct

App1 already has a system-assigned managed identity, so authentication to Microsoft Entra ID is in place; what is missing is authorization to the Azure Files data plane. Assigning Storage File Data Privileged Reader to that identity grants the required read access to the file share through Azure RBAC, and the app can obtain an OAuth token instead of using a storage account key. This is the least-disruptive fix because administrators can continue using storage account keys as described. As scruzer noted, "being authenticated isn't enough" — the managed identity needs an explicit role assignment before it has any file data access.

Why the Other Options Are Wrong

Option A stores and rotates keys in Azure Key Vault, but App1 would still authenticate with a storage account key, so it does not meet the requirement. Option B disables shared key authorization and would indeed block key use, but it also blocks the administrators who still access shares with storage account keys and is broader than necessary. Option C changes the Azure portal's default authorization method for browsing files; it is a portal convenience setting, not a data-plane RBAC grant for App1. The community was split, but ash_niyaz's point that "disabling key access entirely would break that requirement" matches the scenario's explicit administrator constraint.

Community Comment Notes

Eltooth, scruzer and Greens all focus on the missing data-plane role for the managed identity, with Greens noting that Azure Files OAuth access uses the "Privileged" file data roles. rameshms85 and bferdan prefer B to force keyless access, but that reasoning treats enforcement as the goal and overlooks the administrators who still rely on keys. chips and ash_niyaz make the decisive observation that key access must remain available for administrators, so the correct action is to authorize App1's identity rather than disable shared keys. The vote split is a useful reminder that the source key is not authority; the scenario wording decides the answer.

Official Reference

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-assign-share-level-permissions?tabs=azure-portal

This link opens the official vendor documentation in a new tab.

Exam Strategy

Read what must keep working: admins still use storage account keys, so avoid any option that disables shared key access. Then focus on the missing authorization step for App1's managed identity and assign the appropriate Azure Files data-plane RBAC role.

Frequently Asked Questions

Why not disable storage account key access on storage1?

Administrators still access the shares with storage account keys, so disabling shared key access would break their access unless they first migrate to Microsoft Entra ID.

Which Azure RBAC role lets App1's managed identity read Azure Files?

Storage File Data Privileged Reader grants read access to Azure Files data; assign it to App1's managed identity at the share or storage-account scope.

More SC-500 FAQ →

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Eltooth 👍 6 Answered D
    D. Assign the Storage File Data Privileged Reader role to the managed identity of App1. https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-assign-share-level-permissions?tabs=azure-portal Identity-Based Access: To allow App1 to access Azure Files shares without using storage account keys, you must configure role-based access control (RBAC) using Microsoft Entra ID. Assigning a built-in role like Storage File Data Privileged Reader (or Storage File Data SMB Share Reader/Contributor depending on the protocol) directly to App1's system-assigned managed identity allows the application to authenticate natively and securely without relying on access keys.
  2. rameshms85 👍 3 Answered B
    Disabling Storage Account Key Access: To completely enforce that applications and users access storage account resources (such as Azure Files shares) without using storage account keys, you can disable shared key authorization entirely on the storage account by setting Allow storage account key access to Disabled. This forces the storage account to exclusively rely on Microsoft Entra ID (such as managed identities) for authentication and authorization. https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent?tabs=portal
  3. bferdan 👍 3 Answered B
    I believe it's item B, because even assigning a role as indicated in item D, the shared key remains available for use. Therefore, I believe item B, Set Allow storage account key access to Disabled.
  4. chips 👍 3
    It is D because Administrators use the keys to access the Storage Account.
  5. scruzer 👍 2 Answered D
    D. Assign the Storage File Data Privileged Reader role to the managed identity of App1. Identity-based access to Azure Files data requires an Azure RBAC data-plane role on the managed identity. Without a role assignment, the managed identity has no data access at all — being authenticated isn't enough. The "Privileged" file data roles are the ones that grant access over the share regardless of NTFS/Windows ACLs, which is what an app identity needs when there's no AD DS or Entra Domain Services identity behind it.
Show 4 more comments
  1. ash_niyaz 👍 2 Answered D
    The scenario explicitly says administrators still access shares using storage account keys — disabling key access entirely would break that requirement. D is correct, To let App1's managed identity access the file shares, it needs an RBAC role scoped to Azure Files data
  2. shaz22 👍 1 Answered C
    The correct answer is C. Select Default to Microsoft Entra authorization in the Azure portal. Your application App1 uses a system‑assigned managed identity, which means it authenticates using Microsoft Entra ID, not storage account keys. To allow Azure Files access using Entra ID (instead of account keys), the storage account must be configured to use Microsoft Entra authorization as the default authentication method.
  3. robori 👍 1 Answered C
    C. Select Default to Microsoft Entra authorization in the Azure portal. This setting causes requests made to Azure Files through supported clients and applications to use Microsoft Entra ID (formerly Azure AD) authorization rather than Shared Key authorization when possible, allowing App1 to authenticate using its managed identity while administrators can continue using storage account keys.
  4. Greens 👍 1 Answered D
    App1 already has a managed identity. What’s missing is authorization on the data plane. For Azure Files accessed with Entra ID tokens (OAuth over the REST API, which is how a managed identity accesses shares), Microsoft uses the “Privileged” file data roles. Once the role is assigned, App1 authenticates with its identity, and no account key is involved.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Why Is Get Agent Unavailable for an Intune Security Copilot Agent?

S-grade

Can VM Security Group Membership Grant Storage Access?

S-grade

Can Agent ID Developer PIM Settings Be Shortened to Two Days?

S-grade

Can a shared user-assigned identity let VM1 and VM2 access storage1?

S-grade

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide