Exam SC-100 topic 1 question 3 discussion

The two storage workloads that support authentication by using Azure Active Directory (Azure AD) are: A. Azure Storage file shares D. Azure Data Lake Storage Gen2 Explanation: Azure Storage file shares and Azure Data Lake Storage Gen2 both support authentication using Azure AD. Azure Disk Storage and Azure Storage blob containers do not currently support Azure AD authentication.

Azure Files supports identity-based authentication for Windows file shares over SMB using three methods. On-premises AD DS authentication: Azure AD DS authentication: Azure AD Kerberos for hybrid identities: Which means the answer C & D is correct.

Azure File Shares do support authentication by using Azure Active Directory (Azure AD) Domain Services. This allows you to mount a file share on-premises or in the cloud with the SMB protocol using Azure AD credentials. However, it's important to note that this feature is currently only supported with Azure AD Domain Services and not with Azure AD alone

C. Azure Storage blob containers D. Azure Data Lake Storage Gen2

In 2025 the options may have changed, according to this: https://learn.microsoft.com/en-us/azure/storage/common/authorize-data-access?tabs=files-rest Files support EntraID not only with AD DS, there's a REST option that allows MI with EntraID, Also, this article: https://docs.azure.cn/en-us/virtual-machines/managed-disks-overview shows that Azure MANAGED disks (not sure if the managed may make any difference) supports RBAC, so I feel all options are valid and this question is pointless today.

Blob Storage, File Shares, and Data Lake Storage Gen2 all support Entra ID authentication, this question is deprecated. Thank you.

Both Blob and Azure Data Lake storage support Azure RBAC for authorisation, therefore I would go with C and D https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-introduction#:~:text=The%20Azure%20Data%20Lake%20Storage%20access%20control%20model%20supports%20both%20Azure%20role%2Dbased%20access%20control%20(Azure%20RBAC) https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory#:~:text=Authorize%20access%20to%20blobs%20using%20Microsoft%20Entra%20ID

C&D. I have literally just done this in production. I provided access for a service principal to access an azure storage blob container. Azure Data Lake Storage Gen2 is built on top of Azure Blob storage and extends its capabilities and also supports AD authentication.

Files support Azure AD Domain Services and not Azure AD

The correct answers are Azure Storage File Shares and Azure Data Lake Storage Gen2. Azure Disk Storage and Azure Storage Blob Containers don't support Azure AD authentication.

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable

C and D are the correct choice

i think c and d should be assumed to be correct

C and D is the correct answer, I agree

he two storage workloads that support authentication by using Azure Active Directory (Azure AD) in the given scenario are: A. Azure Storage file shares D. Azure Data Lake Storage Gen2 Both Azure Storage file shares and Azure Data Lake Storage Gen2 support authentication through Azure AD. Azure Storage blob containers and Azure Disk Storage do not natively support authentication through Azure AD. However, Azure Disk Storage can be integrated with Azure AD using Managed Service Identity (MSI) to authenticate to other Azure services that support Azure AD. Therefore, the correct answers are Azure Storage file shares and Azure Data Lake Storage Gen2.

To summarize, the correct answers to the original question are A) Azure Storage file shares and D) Azure Data Lake Storage Gen2. Both Azure Storage file shares and Azure Data Lake Storage Gen2 support authentication using Azure Active Directory (Azure AD). Azure Storage blob containers also support authentication using Azure AD, as pointed out in one of your previous messages. Therefore, the correct answers could be A) Azure Storage file shares and C) Azure Storage blob containers, or A) Azure Storage file shares and D) Azure Data Lake Storage Gen2. The statement "To enable AD DS authentication over SMB for Azure file shares, you need to register your storage account with AD DS" is incorrect. To enable Azure Active Directory Domain Services (AD DS) authentication over SMB for Azure file shares, you need to create an AD DS domain, and then join your Azure file shares to the AD DS domain. After you have completed these steps, you can use Azure AD DS to manage and authenticate users and groups for access to the Azure file shares.

Correct