Night-shift staff only need to read blobs in one lock-photo container. Which access design follows least privilege?

Night-shift staff who only need to read blobs in one lock-photo container should receive Storage Blob Data Reader scoped to that container (or an HNS directory) instead of the storage account key. Narrow data-plane RBAC grants read and list without write or delete and keeps authorization attributable to Entra identities. That is least privilege for a single photo drawer on the night shift—not a warehouse master key for the whole civic archive.

Giving every operator the storage account key and relying on informal training not to open other containers fails by concept: either key authorizes broad data-plane operations across the account’s services and cannot enforce container-only discipline through training. Assigning Owner on the subscription so night shift inherits full data-plane rights everywhere fails because Owner is vastly over-scoped for read-only photos in one container. Enabling anonymous public blob access on the account so no RBAC assignment is required fails by removing authentication entirely and exposing civic imagery to the internet.

Exam caveat: scope Storage Blob Data roles to the container or HNS directory when possible; account keys and anonymous access are the anti-patterns the exam contrasts with data-plane RBAC. Operational check: assign Storage Blob Data Reader at the specific lock-photo container, verify night-shift users can read that container only, confirm write/delete fail, and ensure the account key was never distributed for this human access path.