You have an Azure subscription that contains two virtual machines named VM1 and VM2 and...

The solution does not meet the goal because Storage Account Contributor is a management-plane role, not a Blob Storage data-plane role for Microsoft Entra authentication. Microsoft explicitly states that roles such as Owner, Contributor, and Storage Account Contributor do not provide access to blob data through Microsoft Entra ID. Storage Account Contributor can manage the storage account and obtain account keys, but the application is specifically being migrated away from Shared Key authentication. Microsoft Learn

Because each application already obtains Microsoft Entra tokens by using its VM ' s system-assigned managed identity, those identities must receive an Azure RBAC role containing the required Blob Storage DataActions. For read and write access, the appropriate built-in role is Storage Blob Data Contributor, which grants blob read, write, add, move, and delete permissions. Microsoft Learn

The role should be assigned to both VM1 and VM2 managed identities at storage1—or a narrower blob-container scope if practical—to maintain least privilege. No application token-acquisition changes are required.

Therefore, assigning Storage Account Contributor does not provide the required Microsoft Entra-based blob data authorization.