How Do You Grant a Functions Managed Identity Blob Read/Write/Delete Access?
You have an Azure Storage account named storage1 that hosts a blob container named container1. You have an Azure Functions app named app1 that uses a managed identity. You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege. What should you do?
Community Insight
This item tests the distinction between control-plane storage management roles and data-plane blob roles; the trap is picking Storage Account Contributor because its name sounds storage-wide.
Granting an Azure Functions managed identity read, write, and delete access to container1 requires a data-plane Azure RBAC role scoped to the container. Storage Blob Data Contributor is the least-privilege built-in role for those blob operations, making option D correct.
The most common mistake is choosing Storage Account Contributor (A), which manages the storage account itself but does not grant the data-plane permissions to read, write, or delete blobs.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Storage Blob Data Contributor is the built-in Azure RBAC role that grants data-plane permissions to read, write, and delete blobs in a container. Assigning it to app1's managed identity at the scope of container1 grants exactly the blob operations required while avoiding account-wide access. The managed identity provides the Entra ID identity, and the role assignment authorizes that identity against blob data. Because the assignment is scoped to container1 rather than storage1, it also satisfies least privilege.Why the Other Options Are Wrong
Storage Account Contributor (A) is a control-plane role for managing the storage account and its settings, not for reading or writing blob contents. Storage Blob Delegator (B) is used to obtain a user delegation SAS for blobs, which is not the same as granting app1 persistent read/write/delete data access. Owner (C) grants broad management and role-assignment rights and is both overprivileged and not the correct data-plane role for blob contents.Community Comment Notes
The voter goalgoal selected D and framed the managed identity as the app's Azure "badge," noting that Storage Blob Data Contributor supplies "data-plane permissions needed to read, write, and delete blobs." That aligns with the role's documented purpose and the least-privilege requirement in this scenario.Official Reference
Exam Strategy
When a question mentions reading, writing, or deleting blob contents, look for a data-plane role such as Storage Blob Data Contributor, not a control-plane role such as Contributor or Owner. Scope the assignment to the narrowest resource, here container1, to satisfy least privilege.
Frequently Asked Questions
Why isn't Storage Account Contributor sufficient for blob read/write/delete?
It is a control-plane role for managing the storage account itself, not a data-plane role for blob contents, so it does not grant the required read/write/delete blob actions.
Why scope Storage Blob Data Contributor to container1 instead of storage1?
Container scope grants only the needed data access on that container, while account scope would also cover every other container and violate least privilege.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →