nerdexam
Microsoft

AZ-104 · Question #64

Drag and Drop Question You have an Azure subscription named Sub1 that contains two users named User1 and User2. You need to assign role-based access control (RBAC) roles to User1 and User2. The…

The correct answer is User1: Reader and Data Access; User2: Owner. User1 requires 'Reader and Data Access' because this role grants the ability to view (read) data within storage accounts, including listing storage account keys to access blob, queue, and table data - satisfying the requirement with least privilege. User2 requires 'Owner'…

Submitted by brentm· Mar 4, 2026Manage identity and access - specifically implementing role-based access control (RBAC) with appropriate built-in roles in Microsoft Azure (AZ-104 / AZ-900)

Question

Drag and Drop Question You have an Azure subscription named Sub1 that contains two users named User1 and User2. You need to assign role-based access control (RBAC) roles to User1 and User2. The users must be able to perform the following tasks in Sub1: - User1 must view the data in any storage account. - User2 must assign users the Contributor role for storage accounts. The solution must use the principle of least privilege. Which RBAC role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. Answer:

Exhibits

AZ-104 question #64 exhibit 1
AZ-104 question #64 exhibit 2

Answer Area

Drag items

OwnerContributorReader and Data AccessStorage Account Contributor

Correct arrangement

  • User1: Reader and Data Access
  • User2: Owner

Explanation

User1 requires 'Reader and Data Access' because this role grants the ability to view (read) data within storage accounts, including listing storage account keys to access blob, queue, and table data - satisfying the requirement with least privilege. User2 requires 'Owner' because assigning RBAC roles (such as granting users the Contributor role) requires the Microsoft.Authorization/roleAssignments/write permission, which is only available in the Owner role (not Contributor or Storage Account Contributor). The principle of least privilege is maintained by not assigning Owner to User1, who only needs data-read access.

Topics

#RBAC#Azure Storage#Identity and Access Management#Principle of Least Privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-104 Practice