A storage automation service principal must upload, read, and delete blob data in one container by using Microsoft Entra authentication. It must not manage storage account settings, keys, or other containers. Which approach is best?

Assign Storage Account Contributor at the resource group scope.

This grants management-plane control over the storage account and is much broader than needed.

Assign Reader and give the service principal a storage account access key.

This introduces stored credentials and does not follow the Entra-based least-privilege requirement.

Assign Contributor at the subscription scope and restrict access with naming conventions.

Naming conventions do not enforce security, and subscription scope is unnecessarily broad.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a custom role with blob dataActions only and assign it at the container scope. — Blob upload, read, and delete operations are data-plane actions, so they require dataActions rather than management-plane actions. Using a custom role with only the required blob dataActions keeps the permission set small and avoids access to keys, networking, or account configuration. Assigning the role at the container scope further limits the blast radius to just one container, which is exactly what least privilege should do. Why others are wrong: Storage Account Contributor and subscription-level Contributor both expose far more administrative control than required. Reader plus access keys violates the no-stored-credentials goal and still does not represent clean Entra-based delegation. The correct design is to grant only the blob data actions needed at the container scope.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.