Per Microsoft SC-300 official study guide and Microsoft Learn module "Manage identities using managed identities" , when a web app uses a system-assigned managed identity , Azure automatically creates a service principal representing that identity within Microsoft Entra ID.
To grant the managed identity permission to read and write files in an Azure Storage account, you must configure role-based access control (RBAC) permissions via the Access control (IAM) blade in the Azure portal. Specifically, you would assign roles such as Storage Blob Data Contributor or Storage Blob Data Reader to the managed identity at the appropriate resource scope (e.g., storage account or container).
Other options like SAS tokens , access keys , or File share settings rely on key-based or manual authentication methods, which contradict the principle of least privilege and managed identity automation.
Access control (IAM) ensures secure, identity-based access through Azure AD.
# Correct Answer: B. the Access control (IAM) settings