Night-shift staff only need to read blobs in one lock-photo contain…

Question

Night-shift staff only need to read blobs in one lock-photo container. Which access design follows least privilege?

Accepted Answer

Assign Storage Blob Data Reader scoped to that container (or an HNS directory) instead of sharing the storage account key. — One photo drawer, one read-only badge. Scope Storage Blob Data Reader to that container—don’t hand over the master account key to the whole warehouse.

Answer

Give every operator the storage account key and rely on informal training not to open other containers.

Answer

Assign Owner on the subscription so night shift inherits full data-plane rights everywhere.

Answer

Enable anonymous public blob access on the account so no RBAC assignment is required.

Night-shift staff only need to read blobs in one lock-photo container. Which access design follows least privilege?

Short Explanation

Full Explanation