How Do You Grant a Functions Managed Identity Blob Read/Write/Delete Access?
Short answer
D Assign Storage Blob Data Contributor to app1's managed identity at container1 scope for least-privilege read, write, and delete blob access.
Question
You have an Azure Functions app named app1 that uses a managed identity.
You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege.
What should you do?
Key Takeaways
This item tests the distinction between control-plane storage management roles and data-plane blob roles; the trap is picking Storage Account Contributor because its name sounds storage-wide.
Granting an Azure Functions managed identity read, write, and delete access to container1 requires a data-plane Azure RBAC role scoped to the container. Storage Blob Data Contributor is the least-privilege built-in role for those blob operations, making option D correct.
Common mistake: The most common mistake is choosing Storage Account Contributor (A), which manages the storage account itself but does not grant the data-plane permissions to read, write, or delete blobs.
Expert Analysis
Why the Answer Is Correct
Storage Blob Data Contributor is the built-in Azure RBAC role that grants data-plane permissions to read, write, and delete blobs in a container. Assigning it to app1's managed identity at the scope of container1 grants exactly the blob operations required while avoiding account-wide access. The managed identity provides the Entra ID identity, and the role assignment authorizes that identity against blob data. Because the assignment is scoped to container1 rather than storage1, it also satisfies least privilege.
Why the Other Options Are Wrong
Storage Account Contributor (A) is a control-plane role for managing the storage account and its settings, not for reading or writing blob contents. Storage Blob Delegator (B) is used to obtain a user delegation SAS for blobs, which is not the same as granting app1 persistent read/write/delete data access. Owner (C) grants broad management and role-assignment rights and is both overprivileged and not the correct data-plane role for blob contents.
Community Comment Notes
The voter goalgoal selected D and framed the managed identity as the app's Azure "badge," noting that Storage Blob Data Contributor supplies "data-plane permissions needed to read, write, and delete blobs." That aligns with the role's documented purpose and the least-privilege requirement in this scenario.
Official Reference
- https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage
- https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question mentions reading, writing, or deleting blob contents, look for a data-plane role such as Storage Blob Data Contributor, not a control-plane role such as Contributor or Owner. Scope the assignment to the narrowest resource, here container1, to satisfy least privilege.
Frequently Asked Questions
Why isn't Storage Account Contributor sufficient for blob read/write/delete?
Why scope Storage Blob Data Contributor to container1 instead of storage1?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
goalgoal 👍 1 Answered DApp1 already has a managed identity—its Azure “badge.” Now that identity needs permission to work with the actual blob data. Storage Blob Data Contributor provides the data-plane permissions needed to read, write, and delete blobs.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →