CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Mastering Azure Blob Storage Access Management in AZ-104
Learn how to effectively manage access to Azure Blob storage for teams in the AZ-104 certification exam with this detailed question walkthrough.
Managing access to Azure Blob storage can confuse candidates. The right approach requires an understanding of Azure's identity and access management features. Let's break down a relevant exam question to clarify this topic.
The question
Your organization has multiple Azure subscriptions, and you need to manage access to Azure Blob storage for different teams. What should you use to achieve this effectively?
- A. Shared Access Signatures (SAS)
- B. Azure Active Directory (Azure AD) roles
- C. Storage account keys
- D. Azure Policy
Think before you scroll
Consider the nature of access management in Azure. You need to support multiple teams with varying permissions without compromising security. Weigh the options based on granularity and centralized management capabilities.
The answer
The correct option is B. Azure Active Directory (Azure AD) roles. Azure AD roles allow you to assign permissions based on user roles, making it effective for managing access to resources like Blob storage. This approach enables centralized management and aligns with best practices for security.
Why the other options lose
A. Shared Access Signatures (SAS): SAS tokens provide temporary access to Azure resources. While useful for granting limited-time access, they lack centralized management. Using SAS can lead to security risks if not monitored properly.
C. Storage account keys: These keys provide full access to the storage account. Granting access through keys is not advisable for granular permissions. This method can lead to over-provisioning and potential security vulnerabilities.
D. Azure Policy: Azure Policy is designed for governance and compliance, not for managing access controls. While it helps enforce rules and standards, it does not manage user permissions directly.
The concept behind it
Understanding role-based access control (RBAC) is crucial. Azure AD roles allow fine-tuned access management, enabling organizations to assign permissions based on specific roles. This ensures that users have the access they need without compromising security.
Exam trap to remember
Remember the principle of least privilege: always assign the minimum permissions necessary for users to perform their tasks. This will guide you in choosing Azure AD roles over broader access methods.