You have an Azure subscription that contains a storage account named storageacct1234 and two users...

n this scenario, User1 has two role assignments:

Reader (Inherited from Resource Group scope)

Scope: Resource Group (inherited)

Permission type: Read-only access

Allows User1 to view the configuration and properties of Azure resources within the resource group (including the storage account).

However, it does not allow data operations, such as reading or writing blob contents.

Storage Blob Data Contributor (Assigned at “This resource” level)

Scope: storageacct1234 (this resource)

Permission type: Data access for blob content

Allows read, write, and delete operations on blob data in the storage account.

According to Microsoft Azure built-in roles documentation:

Reader role: “View Azure resources but cannot make any changes.”

Storage Blob Data Contributor role: “Grants read, write, and delete permissions to Azure Storage blob containers and data.”

This means:

User1 can upload blobs because the Storage Blob Data Contributor role provides write permissions.

User1 can view blob data because the same role provides read access to blob content.

User1 cannot assign roles (no RBAC management rights, as the role doesn’t include Microsoft.Authorization/* actions).

User1 cannot modify the firewall or network settings of the storage account — those actions require Contributor or Owner roles at the management plane level.

User1 can view file shares under the storage account metadata due to Reader access but cannot access data within them because that requires Storage File Data SMB Share Reader/Contributor permissions (different data plane).

✅ Final Verified Answers:

B. Upload blob data to storageacct1234

D. View blob data in storageacct1234

Summary (from Microsoft Role Documentation Extracts):

Storage Blob Data Contributor = Can read/write/delete blob data (Data Plane)

Reader = Can view Azure resource configuration (Management Plane)

No permission to assign roles or modify security/firewall settings.