Explanation:
File1: # User2 and User3 only
File2: # User3 only
According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn documentation on Azure Role-Based Access Control (RBAC) and Storage Account Data Access , Azure roles define what operations a user can perform on storage resources (containers, blobs, file shares, queues, tables, etc.).
Let's analyze the data provided:
Storage Account Structure Name
Type
Contents
cont1
Container
File1
share1
File share
File2
User Roles User
Role
Scope
User1
Reader
Sub1
User2
Reader
Sub1
User2
Storage Blob Data Reader
storage1
User3
Storage Contributor
storage1
* Reader (at Subscription Scope):
* Grants read-only access to Azure resource metadata, but not the data within storage (no blob or file content access).
* Therefore, User1 and User2 (via Reader) can see the storage account in the portal but cannot read file contents.
* Storage Blob Data Reader:
* Grants read-only access to blob data in containers.
* Applies only to Azure Blob storage (containers), not file shares.
* Therefore, User2 can read File1 (in cont1) but not File2 (in share1).
* Storage Contributor:
* Grants full read/write access to both Blob and File shares data in the storage account.
* Therefore, User3 can read File1 and File2.
Understanding the Roles