AZ-204 Develop for Azure storage Practice Question
You need to grant a user from another Microsoft Entra ID tenant access to a specific blob container in your Azure Storage account. The solution must use Azure RBAC and minimize administrative overhead. What should you do?
⚠ Common exam trap
Test-takers frequently confuse RBAC with shared access signatures or account keys, assuming that any cross-tenant access requires a SAS token, when in fact Azure AD B2B collaboration with RBAC is the correct, low-overhead solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Invite the user as a guest in your Microsoft Entra ID tenant and assign the Storage Blob Data Reader role to the container.
It uses Azure RBAC to grant cross-tenant access by inviting the user as a guest in your Microsoft Entra ID tenant, then assigning the Storage Blob Data Reader role at the container scope. This minimizes administrative overhead by leveraging existing role assignments without managing shared keys or SAS tokens, and it follows the principle of least privilege by scoping access to a specific container.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate a shared access signature (SAS) with read permissions for the container.
Why it's wrong here
Generating a Shared Access Signature (SAS) provides a time-limited, delegated URI to grant access to specific storage resources. While it can grant read permissions to a container, it does not integrate with Azure Role-Based Access Control (RBAC) or leverage the user's Microsoft Entra ID identity for authentication. This method bypasses identity-based access management and auditability, making it less suitable for managing a specific user's permissions within an Entra ID tenant.
- ✓
Invite the user as a guest in your Microsoft Entra ID tenant and assign the Storage Blob Data Reader role to the container.
Why this is correct
Inviting the user as a guest in your Microsoft Entra ID tenant establishes a B2B collaboration relationship, allowing their external identity to be recognized within your tenant. Once the user is a guest, you can then assign Azure RBAC roles, such as 'Storage Blob Data Reader', directly to the specific container. This approach provides secure, identity-based access with granular control and adheres to the principle of least privilege, as the user only gains the necessary permissions to the specified resource.
- ✗
Add the user as a Storage Blob Data Reader at the storage account level.
Why it's wrong here
Assigning the 'Storage Blob Data Reader' role at the storage account level would indeed grant the user read access to storage blobs. However, this assignment would apply to *all* containers within that storage account, not just the specific one mentioned in the requirement. This violates the principle of least privilege by granting broader access than necessary, making it an overly permissive solution for the stated need.
- ✗
Share the storage account key with the user.
Why it's wrong here
Sharing the storage account key grants full administrative access to all data within the entire storage account, bypassing all Azure Role-Based Access Control (RBAC) policies. This method provides far more permissions than the requested read access to a single container and is highly insecure due to the key's broad capabilities. It is not an identity-based solution and should be avoided for user access management.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.