The answer is that the role assignment’s Principal property is set to an Azure AD tenant instead of a specific user or group. This is the issue because Azure RBAC IP conditions are evaluated per principal; when the principal is the entire tenant, the condition is effectively bypassed for all users, allowing blob listing from any IP. The custom role definition’s IP condition in the ‘Condition’ property is correctly scoped to 203.0.113.0/24, but the assignment scope overrides it when applied at the tenant level. On the AZ-204 exam, this tests your understanding of how Azure RBAC conditions interact with role assignment scopes—a common trap is assuming the condition alone enforces the restriction, when in fact the principal must be a specific user or group for the IP filter to take effect. Remember: conditions bind to the principal, not the scope; if the principal is “everyone,” the condition applies to no one specifically. Memory tip: “Tenant-wide principal, condition sidelined.”
AZ-204 Develop for Azure storage Practice Question
This AZ-204 practice question tests your understanding of develop for azure storage. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Refer to the exhibit. You are configuring access to an Azure Storage container using Azure RBAC via a custom role definition. You want to allow a user to list blobs in a container only if the request originates from the IP range 203.0.113.0/24. However, the user reports that they can list blobs from any IP. What is the issue?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Principal is set to an Azure AD tenant instead of a specific user or group
Option A is correct because the custom role definition's 'AssignableScopes' property must be set to a scope that includes the user or group, but the issue here is that the role assignment's 'Principal' property is set to an Azure AD tenant instead of a specific user or group. When the principal is set to the tenant, the role assignment applies to all users in the tenant, bypassing the IP condition because the condition is evaluated per principal. To enforce the IP condition, the role must be assigned to a specific user or group, not the entire tenant.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The Principal is set to an Azure AD tenant instead of a specific user or group
Why this is correct
RBAC assignments require a specific principal (user, group, or service principal), not a tenant.
Related concept
Read the scenario before looking for a memorised answer.
✗
The Resource should be the storage account resource ID, not the container resource ID
Why it's wrong here
The resource is correctly scoped to the container. The issue remains the principal.
✗
The Action should be 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'
Why it's wrong here
The action 'containers/read' is for listing blobs, which is correct for List operation. However, the principal is still wrong.
✗
The Condition for IP address is incorrectly formatted
Why it's wrong here
The condition syntax is correct for RBAC conditions, but the principal is the root cause.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Microsoft often tests the misconception that the role definition's 'AssignableScopes' or the condition syntax is the issue, when in reality the problem is that the role assignment's principal is set to the entire Azure AD tenant, which bypasses any conditions because conditions are evaluated per principal.
Detailed technical explanation
How to think about this question
Azure RBAC conditions for IP restrictions use the 'Conditions' property in a role assignment, which is evaluated at runtime via Azure Policy's attribute-based access control (ABAC). The condition must be applied to a role assignment that targets a specific principal (user or group) to be enforced; when assigned to a tenant, the condition is ignored because the tenant-level assignment overrides per-user conditions. In practice, this means the IP condition is only evaluated when the role assignment is scoped to a user or group, and the condition expression must use the correct attribute path, such as '@Resource[Microsoft.Storage/storageAccounts/blobServices/containers/blobs:ipAddress]'.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-204 question in full detail.
Develop for Azure storage — This question tests Develop for Azure storage — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The Principal is set to an Azure AD tenant instead of a specific user or group — Option A is correct because the custom role definition's 'AssignableScopes' property must be set to a scope that includes the user or group, but the issue here is that the role assignment's 'Principal' property is set to an Azure AD tenant instead of a specific user or group. When the principal is set to the tenant, the role assignment applies to all users in the tenant, bypassing the IP condition because the condition is evaluated per principal. To enforce the IP condition, the role must be assigned to a specific user or group, not the entire tenant.
What should I do if I get this AZ-204 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.