Explanation:
The conditions are difficult to read, but they mean (according to reference 1):
a. If the user performs a reading operation, then he may only read from "cont1" b. If the user performs a writing operation, then he may only write to blobs like "*2*" Given that, then:
1- User 1 can read Blob2 - No, because he is reading, then the condition a. applies, and he is not reading cont1
2- User 1 can read Blob3 - No, because he is reading, then the condition a. applies, and he is not reading cont1
3- User 2 can read blob 1 - Yes. He is not writing, so the condition b. does not apply. He has permissions granted by the role on the scope he is reading - Storage Blob Data Owner on storage1, which contains blob1 References:
https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-format
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles