AZ-104 Implement and Manage Storage Practice Question
An Azure Automation job running on a VM uses a managed identity to upload and overwrite JSON files in one container named configs. The job must not list, delete, or modify any other containers in the storage account. Which role assignment is the best choice?
⚠ Common exam trap
Test-takers frequently choose Storage Blob Data Owner at the storage account scope (Option B) because they think 'Owner' is necessary for overwriting files, but they overlook that 'Contributor' at the container scope already includes write permission and avoids granting excessive container management rights.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Storage Blob Data Contributor at the configs container scope
The Storage Blob Data Contributor role at the container scope grants the managed identity the necessary permissions to upload and overwrite blobs (including JSON files) within the 'configs' container, while explicitly preventing listing, deleting, or modifying other containers in the storage account. This role includes the 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write' action, which allows overwriting existing blobs, but does not include any actions on the container itself (like listing or deleting containers) or on other containers. Scoping the role to the specific container ensures the principle of least privilege is strictly followed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Storage Blob Data Contributor at the configs container scope
Why this is correct
This role grants the blob data permissions the automation job needs while avoiding storage account keys or SAS tokens. Assigning it at the container scope ensures the identity can work only inside the configs container and cannot touch unrelated containers. It is the narrowest assignment that still allows upload and overwrite operations, which makes it the best least-privilege choice.
- ✗
Storage Blob Data Owner at the storage account scope
Why it's wrong here
While Storage Blob Data Owner does authorize blob data-plane operations, scoping it to the entire storage account grants the managed identity read, write, delete, and ownership (ACL-change) permissions on every blob container in that account, not just the configs container. This is far broader than the automation job requires and violates the principle of least privilege. The correct scope is the specific container, and the role should be limited to the necessary write actions—Storage Blob Data Owner at account scope is a classic over-privileged assignment.
When this WOULD be correct
This option would be correct if the job needed to manage all blobs and containers in the storage account, including setting ownership and ACLs, and the requirement allowed full access to all containers.
- ✗
Contributor at the resource group scope
Why it's wrong here
Contributor is an Azure RBAC management-plane role that permits full control over resources (e.g., creating or deleting VMs, subnets, and storage accounts) but grants zero permissions to data-plane operations. Even with this role at the resource-group scope, the managed identity cannot write a blob to a container because Microsoft.Storage/blobServices/containers/blobs/write is not included in the role's actions. Assigning it would also expose the identity to management operations across the entire resource group, violating least privilege.
When this WOULD be correct
This role would be correct in a scenario where the job needs full management control over all resources within a resource group, such as deploying and managing VMs, networks, and storage accounts, without needing to restrict permissions to a specific container.
- ✗
Storage Queue Data Contributor at the storage account scope
Why it's wrong here
This role is exclusively for Microsoft.Storage/storageAccounts/queueServices/queues operations—it allows reading, writing, and deleting queue messages but has no effect on blob containers or blobs. Since the automation job uploads JSON files to a blob container (the configs container), this role would not authorize any part of that operation. Even if the identity also had a blob role, assigning Queue Data Contributor at account scope would still be irrelevant and an unnecessary grant.
When this WOULD be correct
An Azure Automation job needs to read, write, or delete messages from a specific storage queue. For example, a job that processes order messages from a queue named 'orders' would require Storage Queue Data Contributor at the queue scope.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Storage Blob Data Contributor at the configs container scopeCorrect answer▾
Why this is correct
This role grants the blob data permissions the automation job needs while avoiding storage account keys or SAS tokens. Assigning it at the container scope ensures the identity can work only inside the configs container and cannot touch unrelated containers. It is the narrowest assignment that still allows upload and overwrite operations, which makes it the best least-privilege choice.
✗Storage Blob Data Owner at the storage account scopeWrong answer — click to see why▾
Why this is wrong here
Storage Blob Data Owner at the storage account scope grants full control over all blobs and containers, including the ability to list, delete, or modify any container, which violates the requirement to restrict actions to only the configs container.
★ When this WOULD be the correct answer
This option would be correct if the job needed to manage all blobs and containers in the storage account, including setting ownership and ACLs, and the requirement allowed full access to all containers.
Why candidates choose this
Candidates may think 'Owner' is the most powerful role and assume it's always best, overlooking the principle of least privilege and the specific scope restriction in the question.
✗Contributor at the resource group scopeWrong answer — click to see why▾
Why this is wrong here
Contributor at the resource group scope grants full management access to all resources in the resource group, including the ability to list, delete, or modify any storage containers, which violates the requirement to restrict actions to only uploading/overwriting JSON files in the configs container.
★ When this WOULD be the correct answer
This role would be correct in a scenario where the job needs full management control over all resources within a resource group, such as deploying and managing VMs, networks, and storage accounts, without needing to restrict permissions to a specific container.
Why candidates choose this
Candidates may choose Contributor because it is a common, broad role that seems sufficient for 'running a job on a VM', without realizing that the question specifically requires least privilege and container-level scoping.
✗Storage Queue Data Contributor at the storage account scopeWrong answer — click to see why▾
Why this is wrong here
Storage Queue Data Contributor grants permissions to queue data (messages), not blob storage. The job needs to upload/overwrite JSON files in a blob container, not interact with queues.
★ When this WOULD be the correct answer
An Azure Automation job needs to read, write, or delete messages from a specific storage queue. For example, a job that processes order messages from a queue named 'orders' would require Storage Queue Data Contributor at the queue scope.
Why candidates choose this
Candidates may confuse 'queue' with 'container' or assume 'Data Contributor' covers all storage data types, not realizing it's specific to queue storage.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Blob
A blob is a large piece of unstructured data, like a photo or video, stored in the cloud with a unique identifier.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An Azure Function App and an Azure Automation runbook both need to upload, read, and delete blobs in one container. You must avoid stored secrets and keep the permissions as limited as possible. Which two configuration choices should you make? Select two.
hard- ✓ A.Create a user-assigned managed identity that can be attached to both Azure resources.
- ✓ B.Grant Storage Blob Data Contributor on the target container to that identity.
- C.Store the storage account access key in both app settings and runbook variables.
- D.Assign Contributor on the storage account because it automatically includes all blob data permissions.
- E.Use a shared SAS token without an expiration date for both workloads.
Why A: A user-assigned managed identity provides a secure, credential-free authentication method for Azure resources. It allows both the Function App and Automation runbook to authenticate to Azure Storage without storing any secrets, meeting the requirement to avoid stored secrets.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.