Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
Azure Blob Upload 403 Forbidden — RBAC Role Missing
A developer writes an Azure Function that uses the Azure.Storage.Blobs SDK to upload a file to Blob Storage. The function runs locally but fails when deployed to Azure with a '403 Forbidden' error. What is the most likely cause?
Quick Answer
The correct answer is that the function app lacks the required RBAC role on the storage account. This happens because when the Azure Function runs locally, it typically uses your personal Azure AD credentials or a connection string, which already have the necessary permissions. However, once deployed to Azure, the function relies on its own managed identity, and unless that identity has been explicitly assigned a role like Storage Blob Data Contributor on the target storage account, any SDK call to upload a blob will be rejected with a 403 Forbidden error. On the AZ-204 exam, this scenario tests your understanding of managed identities and role-based access control for Azure resources—a core concept in securing serverless applications. A common trap is to blame the function runtime or firewall rules, but the key distinction is that the error only appears after deployment, pointing squarely to an identity and permissions gap. Memory tip: "Local works, cloud fails? Check the role, not the code."
⚠ Common exam trap
Watch out — candidates often assume a 403 always means a network firewall issue (Option D), but Azure Functions in the Consumption plan use managed identity by default, and the most common cause is missing RBAC role assignment on the storage account, not IP whitelisting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The function app does not have the correct RBAC role on the storage account
The 403 Forbidden error when an Azure Function runs in Azure but not locally typically indicates an authorization failure. By default, Azure Functions use managed identity to access storage accounts, and the function app's system-assigned managed identity must be granted the appropriate RBAC role (e.g., Storage Blob Data Contributor) on the storage account. Without this role, the SDK's request to Blob Storage is denied, resulting in a 403.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The function app does not have the correct RBAC role on the storage account
Why this is correct
Managed identity needs Storage Blob Data Contributor role to write blobs.
- ✗
The Azure.Storage.Blobs SDK version is deprecated
Why it's wrong here
Deprecated SDK would cause compilation errors, not runtime 403.
- ✗
The function runtime version is incompatible
Why it's wrong here
Runtime version does not cause authentication errors.
- ✗
The storage account is behind a firewall and the function app's outbound IP is not whitelisted
Why it's wrong here
This is possible but less likely; managed identity uses the Azure backbone network.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Durable Functions
Durable Functions is an extension of Azure Functions that lets you write stateful workflows in code, managing complex sequences of tasks, retries, and delays automatically.
Key term
Azure Functions Bindings
Azure Functions Bindings are declarative connections that link your serverless function code to Azure services or external resources, handling input and output data automatically without writing extra networking or authentication code.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are using Azure CLI to upload a blob using your Azure AD credentials (--auth-mode login). The command fails with an authorization error. What is the most likely cause?
easy- ✓ A.The user does not have the 'Storage Blob Data Contributor' role on the storage account
- B.The Azure CLI version is outdated
- C.The storage account key is not provided
- D.The container name does not exist
Why A: When using `--auth-mode login` with Azure CLI, the operation relies on Azure AD role-based access control (RBAC). The user must be assigned a built-in role like 'Storage Blob Data Contributor' or 'Storage Blob Data Owner' on the storage account to authorize blob uploads. Without this role, the request fails with an authorization error because Azure AD has no permissions to grant access to the blob data plane.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.