AZ104-Q: diagnose private storage access and authorization
A VM accesses a Storage account through a Private Endpoint. The storage account’s public network access is disabled. An operator can see the account in the Azure portal but receives an authorization error when reading blobs. DNS correctly resolves the storage hostname to a private IP. What is the most likely missing configuration?
- A) A public IP on the VM.
- B) Contributor at subscription scope.
- C) An appropriate Azure Storage Blob data-plane RBAC role for the operator at the required scope. ✓
- D) A public DNS zone for the storage endpoint.
Answer: C. Private networking and control-plane visibility do not grant Blob data permission. The operator needs a suitable data-plane role such as Storage Blob Data Reader at the least necessary scope.
Why not the others: A public IP conflicts with the private design. Subscription Contributor is broad and not the correct data-plane permission. DNS is already proven correct.
Related
rbac · private-endpoint · private-dns · storage-network-rule