Hotspot Question You plan to implement an Azure function named Function1 that will create new storage accounts for containerized application instances. You need to grant Function1 the minimum…

Question

Exhibit

Answer Area

• Assign role to:A system-assigned managed identity
  A group accountA system-assigned managed identityA user accountA user-assigned managed identity
• Role assignment to create:Built-in role assignment
  Built-in role assignmentClassic administrator role assignmentCustom role-based access control (RBAC) role assignment

Explanation

This question tests knowledge of assigning managed identities to Azure Functions and using Azure RBAC to grant least-privilege access for resource creation (storage accounts).

Approach. You should enable a System-assigned Managed Identity on Function1 - this eliminates the need to manage credentials and minimizes administrative effort. Then, assign the 'Storage Account Contributor' role (or 'Contributor' scoped appropriately) to that managed identity at the Resource Group or Subscription scope where storage accounts will be created. Using a system-assigned managed identity is preferred over user-assigned when the identity lifecycle should be tied to the function, and 'Storage Account Contributor' is the minimum built-in role that allows creating and managing storage accounts without granting broader permissions like 'Owner'.

Concept tested. Azure Managed Identity + RBAC least-privilege: assigning a system-assigned managed identity to an Azure Function and granting it the minimum required RBAC role (Storage Account Contributor) to create storage accounts, rather than using service principals with stored credentials or over-privileged roles like Owner/Contributor at subscription level.

Reference. https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity and https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-account-contributor

No community discussion yet for this question.