Managed identities and least-privilege Azure RBAC

Secrets in code and shared keys are the most common way cloud workloads get breached. The exam expects you to replace them with identities and the smallest role that works.

Managed identities

A managed identity is a Microsoft Entra identity whose credentials Azure creates and rotates for you. The app requests a token and never stores a secret.

Type	Lifecycle	Best for
System-assigned	Tied to one resource, deleted with it	One resource with its own access needs
User-assigned	Separate resource, attach to many	Many resources sharing the same access, fewer identities to manage

When a question says “minimise the number of identities”, choose user-assigned.

Control plane versus data plane

Azure RBAC has two kinds of roles. Control-plane roles such as Contributor manage the resource. Data-plane roles read and write the content.

• Blob access: Storage Blob Data Reader, Storage Blob Data Contributor (read, write, delete), Storage Blob Data Owner.
• Files: Storage File Data SMB Share Contributor and similar roles. Storage File Data Privileged Reader is read-only and bypasses file ACLs.
• Key Vault (RBAC permission model): Key Vault Secrets User reads secrets, Key Vault Crypto User uses keys, Key Vault Administrator manages everything.
• Virtual machine sign-in with Entra: Virtual Machine User Login for normal users, Virtual Machine Administrator Login for admins.

Storage Account Contributor and Owner do not grant blob data access through Entra, and they are far too broad for a workload.

Scope

Assign roles at the lowest scope that satisfies the requirement: container, then storage account, then resource group, subscription, management group. A role at a management group is inherited by every subscription below it, so use it only when the requirement spans them.

Removing keys and passwords

• Storage: set Allow storage account key access to Disabled so only Entra authorization works. Optionally set Default to Microsoft Entra authorization in the portal.
• Azure SQL: enable Microsoft Entra-only authentication on the server. Logins remain in the databases but cannot be used.
• Storing keys in Key Vault is better than in code, but it is not the same as keyless access.

Role assignment rights

Only Owner, User Access Administrator and Role Based Access Control Administrator can create role assignments. The RBAC Administrator role can be limited with conditions to specific roles. Contributor cannot assign roles.

Exam traps

• Confusing Storage Blob Delegator (user delegation keys for SAS) with a data role. It does not read blobs.
• Choosing Owner or Contributor “because it works”. The exam always wants the narrowest role.
• Thinking Entra-only authentication deletes SQL logins. It only blocks them.
• Using Conditional Access for SQL authentication. Conditional Access applies to Entra sign-ins, not SQL logins.
• Picking system-assigned when many apps need the same access and the question asks for fewer identities.

Practice questions

Choose an answer, then review the explanation to check your understanding.

1. An Azure Functions app must read, write and delete blobs in one container, with least privilege. What do you assign to its managed identity?

1. A.Storage Account Contributor on the storage account
2. B.Storage Blob Data Contributor scoped to the container
3. C.Storage Blob Delegator on the storage account
4. D.Owner on the resource group

Show answer

Answer: B.Storage Blob Data Contributor is a data-plane role that allows read, write and delete of blobs. Assign it at container scope to keep it narrow.

2. Several web apps must read secrets from one key vault. You must minimise the number of identities. What do you use?

1. A.One system-assigned identity per app
2. B.One user-assigned managed identity shared by the apps
3. C.One service principal with a client secret per app
4. D.Storage account keys stored in the vault

Show answer

Answer: B.A user-assigned managed identity can be attached to many resources, so one identity and one role assignment cover all apps.

3. Server1 must reject SQL authentication for every database, enforced centrally. What do you enable?

1. A.A Conditional Access policy
2. B.Microsoft Entra-only authentication on the server
3. C.A managed identity on the server
4. D.CREATE USER FROM EXTERNAL PROVIDER in each database

Show answer

Answer: B.Microsoft Entra-only authentication is a server-level setting that disables SQL logins without deleting them.

4. A group must be able to assign roles on two subscriptions in one management group, with least privilege. Which role and scope?

1. A.Owner at the management group
2. B.Contributor at the management group
3. C.User Access Administrator at the management group
4. D.Contributor on each subscription

Show answer

Answer: C.Only User Access Administrator (or Role Based Access Control Administrator) manages role assignments without granting full control of resources. Contributor cannot assign roles.