Microsoft Azure Administrator Associate AZ-104 Practice Question

To grant users the ability to read and write blobs without delete permissions, you need to create a custom role that includes the read and write actions but excludes the delete action. Assigning this custom role to the users via role-based access control (RBAC) ensures they have the exact permissions required. The built-in Storage Blob Data Contributor role grants read, write, and delete permissions, which is more than what's needed. The Storage Blob Data Reader role only allows reading blobs, not writing them. Enabling identity-based access does not address the specific permission settings required in this scenario.