Help-desk staff with Reader can open the storage account blade but cannot reveal access keys, while a custom role that includes Microsoft.Storage/storageAccounts/listKeys/action can. What should the security engineer do?
Select an answer to reveal the explanation.
Short Explanation
listKeys is the button that prints the master key. Keep that action rare—and steer people toward identities that never need the account key at all.
Full Explanation
The Microsoft.Storage/storageAccounts/listKeys/action control-plane permission reveals storage account keys. Built-in Reader cannot list keys; privileged roles or custom roles that include listKeys can. Restricting that action reduces accidental and malicious key disclosure. Preferring managed identities with Storage Blob Data roles avoids standing key use. Spreading keys into shared documents or broadening Owner assignments increases risk.