Azure Managed Identity for Blob Storage Access
An Azure Function App and an Azure Automation runbook both need to upload, read, and delete blobs in one container. You must avoid stored secrets and keep the permissions as limited as possible. Which two configuration choices should you make? Select two.
Quick Answer
The answer is to assign a user-assigned managed identity to both the Function App and the Automation runbook, then grant that identity the Storage Blob Data Contributor role scoped to the target container. This configuration is correct because a managed identity eliminates the need for stored secrets by providing an Azure AD-backed identity that Azure resources can use to authenticate directly to Blob Storage, while the Storage Blob Data Contributor role precisely limits permissions to upload, read, and delete blobs within that single container. On the AZ-104 exam, this scenario tests your understanding of identity-based access control and least-privilege principles, often appearing as a trap where candidates mistakenly choose access keys or system-assigned identities that cannot be shared across resources. A key memory tip is “one shared identity, one scoped role”—remember that a user-assigned managed identity is reusable across multiple resources, and scoping the role to the container (not the storage account) enforces the minimal permissions required.
⚠ Common exam trap
Candidates often confuse the Contributor role on the storage account with data plane permissions, not realizing that Contributor only grants management plane access and does not allow blob operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a user-assigned managed identity that can be attached to both Azure resources.
A user-assigned managed identity provides a secure, credential-free authentication method for Azure resources. It allows both the Function App and Automation runbook to authenticate to Azure Storage without storing any secrets, meeting the requirement to avoid stored secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a user-assigned managed identity that can be attached to both Azure resources.
Why this is correct
A user-assigned managed identity is reusable across resources and avoids storing secrets in application code or configuration.
- ✓
Grant Storage Blob Data Contributor on the target container to that identity.
Why this is correct
This role allows blob data operations without granting storage account management permissions or access to unrelated containers.
- ✗
Store the storage account access key in both app settings and runbook variables.
Why it's wrong here
Account keys are broad secrets that grant more access than needed and create secret-rotation and exposure risks.
When this WOULD be correct
If the question allowed stored secrets and required the simplest configuration without managed identities, using the storage account access key would be correct. For example, 'You need to configure an Azure Function App to access a storage account using a key stored in application settings.'
- ✗
Assign Contributor on the storage account because it automatically includes all blob data permissions.
Why it's wrong here
Contributor manages the resource, but it does not provide the required data-plane permissions for blob access.
When this WOULD be correct
If the question required managing the storage account itself (e.g., create/delete containers, configure firewall rules) and did not involve blob data operations, then assigning Contributor on the storage account would be appropriate.
- ✗
Use a shared SAS token without an expiration date for both workloads.
Why it's wrong here
A long-lived SAS token is not least privilege and introduces a credential that can be leaked or reused.
When this WOULD be correct
This option would be correct if the question asked for a temporary, delegated access solution for a specific blob operation, where the SAS token is generated on-demand with a short expiration and not stored, and the requirement to avoid stored secrets is not present.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a user-assigned managed identity that can be attached to both Azure resources.Correct answer▾
Why this is correct
A user-assigned managed identity is reusable across resources and avoids storing secrets in application code or configuration.
✗Store the storage account access key in both app settings and runbook variables.Wrong answer — click to see why▾
Why this is wrong here
Storing the storage account access key in app settings and runbook variables violates the requirement to avoid stored secrets, as the key is a long-lived secret that must be securely stored and managed.
★ When this WOULD be the correct answer
If the question allowed stored secrets and required the simplest configuration without managed identities, using the storage account access key would be correct. For example, 'You need to configure an Azure Function App to access a storage account using a key stored in application settings.'
Why candidates choose this
Candidates may think using access keys is straightforward and familiar, overlooking the security requirement to avoid stored secrets and the principle of least privilege.
✗Assign Contributor on the storage account because it automatically includes all blob data permissions.Wrong answer — click to see why▾
Why this is wrong here
The Contributor role on the storage account includes management plane permissions (e.g., delete the account) but does NOT automatically grant data plane permissions like blob upload/read/delete. You need a separate data role such as Storage Blob Data Contributor.
★ When this WOULD be the correct answer
If the question required managing the storage account itself (e.g., create/delete containers, configure firewall rules) and did not involve blob data operations, then assigning Contributor on the storage account would be appropriate.
Why candidates choose this
Candidates may mistakenly believe that Contributor on the storage account grants full access to all data within it, confusing management plane roles with data plane roles.
✗Use a shared SAS token without an expiration date for both workloads.Wrong answer — click to see why▾
Why this is wrong here
A shared SAS token without an expiration date violates the principle of least privilege and introduces a persistent security risk; the question explicitly requires avoiding stored secrets and limiting permissions.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a temporary, delegated access solution for a specific blob operation, where the SAS token is generated on-demand with a short expiration and not stored, and the requirement to avoid stored secrets is not present.
Why candidates choose this
Candidates may think a SAS token avoids storing secrets because it is a token, but they overlook the need for an expiration date and the fact that the token itself becomes a stored secret if saved without expiry.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Container
A container is a lightweight, standalone software package that includes everything needed to run an application, such as code, runtime, system tools, and libraries.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An Azure Automation job running on a VM uses a managed identity to upload and overwrite JSON files in one container named configs. The job must not list, delete, or modify any other containers in the storage account. Which role assignment is the best choice?
hard- ✓ A.Storage Blob Data Contributor at the configs container scope
- B.Storage Blob Data Owner at the storage account scope
- C.Contributor at the resource group scope
- D.Storage Queue Data Contributor at the storage account scope
Why A: The Storage Blob Data Contributor role at the container scope grants the managed identity the necessary permissions to upload and overwrite blobs (including JSON files) within the 'configs' container, while explicitly preventing listing, deleting, or modifying other containers in the storage account. This role includes the 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write' action, which allows overwriting existing blobs, but does not include any actions on the container itself (like listing or deleting containers) or on other containers. Scoping the role to the specific container ensures the principle of least privilege is strictly followed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.