A harbor analyst has Contributor on the lock-photo storage account but still cannot list blobs in the portal or tools. What should the security engineer assign?

A harbor analyst with Contributor on the lock-photo storage account who still cannot list blobs needs a storage data-plane role such as Storage Blob Data Reader, Storage Blob Data Contributor, or Storage Blob Data Owner in addition to any management-plane role. Azure Storage separates control-plane RBAC from data-plane RBAC: Contributor can manage the account resource but does not grant blob list/read/write data actions. For civic photo archives, the analyst needs an explicit data-plane assignment at the account, container, or directory scope that matches their job.

Keeping Contributor only and granting the account key so control-plane Contributor becomes data-plane access fails by concept: the account key is a powerful shared secret, not a least-privilege fix for missing data-plane RBAC. Assigning Reader at the subscription and expecting blob listing to succeed without data-plane roles fails because Reader is still management-plane and does not authorize blob data operations. Creating a custom Azure role that only allows Microsoft.Storage/storageAccounts/write and skips blob data actions fails because management write actions do not substitute for Storage Blob Data dataActions.

Exam caveat: management roles (Owner/Contributor/Reader) are not Storage Blob Data Reader/Contributor/Owner; listing blobs in portal or tools requires data-plane authorization (or keys/SAS). Operational check: assign Storage Blob Data Reader (or broader if write is required) to the analyst at the lock-photo container scope, confirm list/read works without sharing the account key, and remove any temporary key use from the municipal access ticket.