AZ-204 Develop for Azure storage Practice Question
Your company has a storage account with a hierarchical namespace enabled (Azure Data Lake Storage Gen2). You need to authorize an application to write data to a specific container using a managed identity. The application runs on an Azure VM with a system-assigned managed identity. Which role assignment should you use?
⚠ Common exam trap
Many candidates confuse Azure RBAC roles (like 'Contributor' or 'Owner') with data plane roles, mistakenly thinking control plane permissions automatically grant data access, but for Azure Storage, data plane and control plane permissions are separate and require specific role assignments like 'Storage Blob Data Contributor'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the 'Storage Blob Data Contributor' role on the container to the managed identity.
The 'Storage Blob Data Contributor' role grants read, write, and delete permissions to blob data at the container scope. For Azure Data Lake Storage Gen2 with a hierarchical namespace, this role provides the necessary ACL-based access for a managed identity to write data to a specific container, without granting control plane permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the 'Storage Blob Data Contributor' role on the container to the managed identity.
Why this is correct
The 'Storage Blob Data Contributor' role provides comprehensive permissions to read, write, and delete blob data within the specified scope. Assigning this role at the container level to the managed identity grants the necessary data plane access to create, modify, and manage blobs and directories within that container, aligning perfectly with the requirement to interact with a hierarchical namespace. This adheres to the principle of least privilege by granting only the required data operations, not broader management capabilities.
- ✗
Assign the 'Contributor' role on the storage account to the managed identity.
Why it's wrong here
The 'Contributor' role operates at the control plane, granting permissions to manage Azure resources themselves, such as creating storage accounts, configuring properties, or managing containers. However, it explicitly does not grant access to the *data* within the storage account's blobs or files. Therefore, while it allows management of the storage account resource, it fails to provide the necessary data plane permissions for the managed identity to write or modify blob content.
- ✗
Assign the 'Storage Blob Data Reader' role on the container to the managed identity.
Why it's wrong here
The 'Storage Blob Data Reader' role is a data plane role that permits listing blobs, reading blob content, and downloading data from a container. While correctly scoped to the container, this role is strictly read-only and does not include any permissions for writing, creating, or modifying blobs or directories. Consequently, it is insufficient for operations that involve adding or changing data within the hierarchical namespace.
- ✗
Assign the 'Owner' role on the storage account to the managed identity.
Why it's wrong here
The 'Owner' role provides full administrative access to an Azure resource, including the ability to manage access control (RBAC) and perform all control plane and data plane operations. While this role would technically grant the required write permissions, assigning 'Owner' violates the fundamental security principle of least privilege. It confers excessive and unnecessary permissions, making it an insecure choice for a managed identity that only requires specific data manipulation capabilities.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.