AZ-204 Implement Azure security Practice Question
Your web app running on Azure App Service requires access to a storage account using managed identity. You enable the system-assigned managed identity on the App Service and assign the 'Storage Blob Data Contributor' role at the storage account scope. However, the app receives 403 errors when trying to read blobs. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently assume the role assignment alone is sufficient, overlooking that the token's audience must match the target service (storage vs. management), which is a subtle but critical detail in managed identity authentication flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The managed identity token is being requested with the wrong audience. You need to specify 'https://storage.azure.com' as the resource.
When using managed identity with Azure Storage, the access token must be requested with the correct audience (resource). For Azure Blob Storage, the audience must be 'https://storage.azure.com'. If the app requests the token with a different audience (e.g., the default Azure Resource Manager endpoint 'https://management.azure.com'), the token will be rejected by the storage service, resulting in a 403 error despite the role assignment being in place.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The managed identity token is being requested with the wrong audience. You need to specify 'https://storage.azure.com' as the resource.
Why this is correct
When an Azure App Service uses a managed identity to access another Azure service, it requests an OAuth 2.0 access token from Azure Active Directory. Each Azure service exposes a specific 'resource' URI, which acts as the audience for the token. For Azure Storage, this required audience is 'https://storage.azure.com', not the default 'https://management.azure.com' used for Azure Resource Manager operations. Requesting a token with the incorrect audience will result in an authorization failure, typically a 403 Forbidden error, because the target service will reject the token as not being issued for its intended use.
- ✗
Managed identity is not supported for Azure App Service; use a connection string instead.
Why it's wrong here
The statement that managed identity is not supported for Azure App Service is incorrect. Azure App Service fully supports both system-assigned and user-assigned managed identities, providing a secure and credential-free way for applications to authenticate to Azure AD-protected services. Utilizing managed identities eliminates the need to store sensitive connection strings or secrets directly within application code or configuration, significantly enhancing security posture and simplifying secret management. This approach is a best practice for secure access to Azure resources.
- ✗
The role assignment has not propagated yet; wait 30 minutes.
Why it's wrong here
While there is a propagation delay for Azure RBAC role assignments, it is typically very short, often within seconds to a few minutes, not 30 minutes for a persistent issue. A persistent 403 error due to an incorrect token audience indicates an immediate authentication/authorization policy rejection, not a temporary delay in role propagation. If the role assignment were truly missing or not propagated, the error might manifest differently or resolve quickly, whereas an audience mismatch is a fundamental configuration error that will persist until corrected.
- ✗
The storage account has a firewall rule that blocks the App Service outbound IPs.
Why it's wrong here
A storage account firewall rule that blocks outbound IPs from an Azure App Service would typically result in a network-level error, such as a connection timeout or a 403 Forbidden error indicating a network policy violation, rather than an authentication-specific issue. This type of error would prevent any network communication from reaching the storage account, regardless of the authentication token presented. The problem described, an incorrect token audience, specifically points to an issue with the authentication process itself, where the connection is established but the authorization token is deemed invalid by the target service.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.