A harbor analyst has Contributor on the lock-photo storage account but still cannot list blobs in the portal or tools. What should the security engineer assign?
Select an answer to reveal the explanation.
Short Explanation
Contributor on the account is the office key to the filing cabinet’s settings—not the key to the photos inside. Hand out Storage Blob Data Reader (or similar) for the actual blob list.
Full Explanation
Azure Storage separates management-plane RBAC from data-plane RBAC. Roles such as Contributor allow resource management but do not grant blob, file, queue, or table data operations. Data-plane roles such as Storage Blob Data Reader, Storage Blob Data Contributor, and Storage Blob Data Owner authorize listing and reading or writing blobs. Sharing the account key bypasses least privilege. Custom roles that only expose management actions do not fix blob access.