Implement Azure security →hardMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

Exhibit

Refer to the exhibit.

{
    "type": "Microsoft.Authorization/roleAssignments",
    "apiVersion": "2022-04-01",
    "name": "[guid(resourceGroup().id, 'Storage Blob Data Contributor')]",
    "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
        "principalId": "[reference(resourceId('Microsoft.Web/sites', 'myapp'), '2022-03-01', 'Full').identity.principalId]",
        "scope": "[resourceId('Microsoft.Storage/storageAccounts', 'mystorageacct')]"
    }
}

Refer to the exhibit. You are deploying an ARM template that assigns the 'Storage Blob Data Contributor' role to the managed identity of an App Service named 'myapp' at the storage account 'mystorageacct' scope. The deployment fails with an error that 'principalId' is null. What is the most likely cause?

⚠ Common exam trap

A common mix-up: candidates assume the error is due to a missing storage account or incorrect role definition, but the null 'principalId' directly points to the managed identity not being enabled on the App Service.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The App Service 'myapp' does not have a managed identity enabled.

The error 'principalId' is null indicates that the ARM template is attempting to assign a role to a principal that does not exist. In this scenario, the principal is the managed identity of the App Service 'myapp'. If the App Service does not have a managed identity enabled, the 'principalId' property in the role assignment resource will be null, causing the deployment to fail. Enabling a system-assigned or user-assigned managed identity on the App Service is required before the role assignment can succeed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The role definition ID is incorrect.
Why it's wrong here
The GUID 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' is the correct and well-known identifier for the built-in 'Storage Blob Data Contributor' role definition in Azure. Since this specific GUID accurately references a valid role that grants necessary permissions for data operations on storage blobs, the problem does not stem from an incorrect role definition ID. The ARM template correctly specifies which role to assign.
✗
The storage account name 'mystorageacct' does not exist.
Why it's wrong here
If the storage account 'mystorageacct' did not exist, the ARM deployment would typically fail with a 'ResourceNotFound' error during the validation or deployment phase when attempting to resolve the scope for the role assignment. This error would indicate an inability to locate the target resource for the role assignment, which is distinct from an issue related to the principal's identity. The problem is not with the existence of the storage account itself.
✗
The role assignment name is not unique.
Why it's wrong here
The `guid()` function in an ARM template is specifically designed to generate a globally unique identifier each time it is invoked. Using this function for the role assignment name ensures that the name is unique within its scope, preventing naming conflicts that would otherwise cause the deployment to fail. Therefore, the role assignment name being non-unique is not the cause of the deployment issue.
✓
The App Service 'myapp' does not have a managed identity enabled.
Why this is correct
For an Azure resource like an App Service to be assigned an Azure RBAC role, it must possess an associated Azure Active Directory identity, which is provided by a managed identity. If the App Service 'myapp' does not have a system-assigned or user-assigned managed identity enabled, it lacks the necessary `principalId` (object ID) that Azure RBAC requires to create the role assignment. Consequently, the deployment fails because the `principalId` property cannot be resolved or is null, preventing the role from being assigned to the service.

Go deeper

AZ-204 Implement Azure security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question