Azure Active Directory (Azure AD) authorizes access rights to secured resources through Azure role-based access control (Azure RBAC). Azure Storage defines a set of Azure built-in roles that encompass common sets of permissions used to access blob data.
When an Azure role is assigned to an Azure AD security principal, Azure grants access to those resources for that security principal. An Azure AD security principal may be a user, a group, an application service principal, or a managed identity for Azure resources.
Scenario:
To access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the app.
The Litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that grants the DataActions read permission to the blobs and files in Azure Storage.
Litware identifies the following security and compliance requirements:
On-premises users and services must be able to access the Azure Storage account that will host the data in App1.
Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access