Question
You have an Azure Storage account named storage1 that contains Azure Files shares.
You have an application named App1 that uses a system-assigned managed identity to access the shares.
Administrators access the shares by using storage account keys.
You need to ensure that App1 access the shares without using the storage account keys.
What should you do on storage1?
- A. Store the storage account access keys in Azure Key Vault and regenerate them periodically.
- B. Set Allow storage account key access to Disabled.
- C. Select Default to Microsoft Entra authorization in the Azure portal.
- D. Assign the Storage File Data Privileged Reader role to the managed identity of App1. Correct
Explanation
A managed identity authenticates with Microsoft Entra ID and is authorized through Azure RBAC, so App1 needs a data role on storage1; Storage File Data Privileged Reader grants read access to share data through OAuth over REST, replacing the account keys. Disabling storage account key access would reject every key-authorized request, which would break the administrators who still use keys. Default to Microsoft Entra authorization only changes how the Azure portal authorizes access for people using the portal, and does not give App1 any permissions. Storing the keys in Key Vault still means using the keys.
