
Explanation:
Box 1: No
User1 has the Reader role. Does not apply to the blob container.
User1 also has the Storage Blob Data Reader with Condition1.
Blob2 is in Cont2.
Condition1 will be false:
The action is ..blob/reads
Resource name is cont2 not cont1
Note: Storage Blob Data Reader
Read and list Azure Storage containers and blobs.
Box 2: Yes
Blob3 is in cont1. Condition1 will be true.
Box 3: Yes
User2 has the Reader role. Does not apply to the blob container.
User2 also has the Storage Blob Data Owner Role with Condition2.
blob1 is in cont1
Condition2 will be true, as the action is read, not a write.