
Explanation:
File1: # User2 and User3 only
File2: # User3 only
According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn documentation on Azure Role-Based Access Control (RBAC) and Storage Account Data Access, Azure roles define what operations a user can perform on storage resources (containers, blobs, file shares, queues, tables, etc.).
Let's analyze the data provided:
Name
Type
Contents
cont1
Container
File1
share1
File share
File2
User
Role
Scope
User1
Reader
Sub1
User2
Reader
Sub1
User2
Storage Blob Data Reader
storage1
User3
Storage Contributor
storage1
* Reader (at Subscription Scope):
* Grants read-only access to Azure resource metadata, but not the data within storage (no blob or file content access).
* Therefore, User1 and User2 (via Reader) can see the storage account in the portal but cannot read file contents.
* Storage Blob Data Reader:
* Grants read-only access to blob data in containers.
* Applies only to Azure Blob storage (containers), not file shares.
* Therefore, User2 can read File1 (in cont1) but not File2 (in share1).
* Storage Contributor:
* Grants full read/write access to both Blob and File shares data in the storage account.
* Therefore, User3 can read File1 and File2.