Question
You have an Azure Databricks workspace named Workspace1 that is attached to a Unity Catalog metastore named metastore1.
You need to register an Azure Storage account named account1 that has a hierarchical namespace enabled as an external location. The external location must use a managed identity to authenticate to account1 and the solution must follow the principle of least privilege.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Explanation
First create the access connector for Azure Databricks, because it holds the managed identity that will authenticate to the storage account. Next, grant that identity access to account1 with the Storage Blob Data Contributor role, which gives the read and write access required; Storage Blob Data Owner is more than needed and breaks least privilege, and the role must go to the connector's identity rather than to Workspace1. Finally, create the storage credential that references the connector. A storage credential is a Unity Catalog object governed at the metastore level, so it belongs in metastore1 rather than in Workspace1, and the external location then references it.
