Exam AZ-500 topic 2 question 77 discussion

User 1 can't read the Storage because Microsoft.Storage/storageAccounts/read will allow him just to LIST the storage accounts User 2 HAS the option to do whatever he want on the storage account so he can read the data. User 3 can't access Azure backup because the provider is not enabled in the Access Policy

I assume that "dataactions" is not set, so data cannot be read.

NNN no data action to read storage data.

actions vs. dataActions - Revisited (and Corrected): actions: Control plane. Managing the resource itself (create, delete, modify settings, list keys). Microsoft.Storage/storageAccounts/read lets you see that a storage account exists and view its properties, but NOT its contents. dataActions: Data plane. Accessing the data within the resource (blobs, queues, tables, files). You need dataActions to read the actual data (blobs, files, etc.) within a storage account. Role1: Has no dataActions. User1 can see the storage account exists and list its keys, but cannot read any blob, file, queue, or table data. Role2: Has Microsoft.Storage/storageAccounts/* under actions. This is a broad control plane permission. It allows User2 to manage the storage account (change settings, etc.), and see it exist. Crucially, Role2 lacks any dataActions permissions. So it CANNOT read data. User3: Inherits the permissions of both roles. Still has no permissions in the dataActions.

Microsoft.Storage/storageAccounts/* : Create and manage storage accounts Microsoft.Storage/storageAccounts/read: Returns the list of storage accounts or gets the properties for the specified storage account. to read blobs' data user should have: 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' --> Return a blob or a list of blobs. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage

User1 can read data in storage1. Yes: User1 is assigned Role1, which allows Microsoft.Storage/storageAccounts/read, granting read access to storage account metadata but not to blobs/files themselves directly. User2 can read data in storage1. Yes: User2 is assigned Role2, which has Microsoft.Storage/storageAccounts/* permissions, providing access to read data within the storage account, including blobs and files. User3 can restore storage1 from a backup in Azure Backup. No: Neither Role1 nor Role2 provide permissions to restore storage accounts from Azure Backup, as there are no permissions related to Azure Backup specifically.

I really hate these question. User1 can read data. What exactly is DATA? If we are talking about storage account properties, sure, he can read that. If we are talking about blobs and files, he can't.

I'm going through the storage account documentation and there is an interesting piece of information "If a role includes Microsoft.Storage/storageAccounts/listKeys/action, then a user to whom that role is assigned can access data in the storage account [...]". Therefore, to me, it actually is: 1. Yes (explicit) 2. Yes (via Microsoft.Storage/storageAccounts/*) 3. No (no backup permissions)

No, Yes, No

Y-Y-N The answer is correct. The description of role 2 is 'Storage Account Contributor' which cannot play backup restore action. Storage Account Contributor: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-account-contributor Storage Account Backup Contributor: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-account-backup-contributor

Role1 has more than just read, it also has ListAccountSas/Action and ListKeys/Action which allows read/write access to data within the storage account: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#reader-and-data-access Dont just get hung up on just the read permission in that role.

The respond is correct surprisingly. The role 1 is a built-in role called "Reader and Data Access". https://www.azadvertizer.net/azrolesadvertizer/c12c1c16-33a1-487b-954d-41c89c60f349.html With Microsoft.Storage/storageAccounts/ListAccountSas/action permission, you may get SAS and do read/write operations. If you see this link, https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles and look for "Reader and Data Access" role, you see its definition. Lets you view everything but will not let you delete or create a storage account or contained resource. It will also allow read/write access to all data contained in a storage account via access to storage account keys. The second box is also yes as it has an asterisk for storageaccount YES, YES, NO

Explanation: USER 1 = Microsoft.Storage/storageAccounts/read= Returns the list of storage accounts or gets the properties for the specified storage account user 2 = wildcards (*) so YES user 3= not defined Microsoft.Storage/storageAccounts/restoreBlobRanges/action

Explanation: USER 1 = Microsoft.Storage/storageAccounts/read= Returns the list of storage accounts or gets the properties for the specified storage account user 2 = wildcards (*) so YES user 3= not defined Microsoft.Storage/storageAccounts/restoreBlobRanges/action

The "Microsoft.Storage/storageAccounts/*/" attribute in a role assignment applies to Azure Storage and provides access to all containers and blobs within all storage accounts in the specified scope. However, it does not provide access to, for example, Azure Backup and does not automatically grant the ability to restore backups from Azure Backup. To grant permissions to restore backups from Azure Backup, you must meet the correct role in the specific scope. Be careful not to get confused.

Why User 3 can not restore a back up even having the permission Microsoft.Storage/storageAccounts/* This is the permission of built-in "storage-account-backup-contributor" role. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-account-backup-contributor

**Role1 Permissions**: - Can list keys, generate SAS, and read storage account properties. By using keys or SAS, **User1** can read data in storage1. Data Actions are not required. **Role2 Permissions**: - Wildcard permissions for storage accounts. So, **User2** can read data in storage1. **User3**: - Has both Role1 and Role2 permissions, but can't restore storage1 from Azure Backup. Thus: 1. User1: **Yes** 2. User2: **Yes** 3. User3: **No**.