The correct role is Storage Blob Data Contributor . The requirement is not to manage the storage account resource itself; it is to allow Workspace1 to perform read, write, and delete operations against blob data stored in containers in storage1 . Microsoft defines Storage Blob Data Contributor as the built-in Azure RBAC role that can “read, write, and delete Azure Storage containers and blobs.”

For an Azure Synapse Analytics workspace, the role would be assigned to the workspace managed identity at the storage account or container scope, depending on the required access boundary. Microsoft’s Synapse guidance states that the Synapse workspace managed identity needs the Storage Blob Data Contributor role on the storage account to access Data Lake Storage and run workloads such as Spark.

The other roles are management-plane roles or insufficient for blob data operations. Storage Account Contributor and Contributor can manage Azure resources but do not directly grant blob data-plane read/write/delete permissions. Reader and Data Access is not the correct least-privilege role for write and delete blob operations. Study Guide reference: AZ-104 Implement and manage storage > configure access to storage, Azure Blob Storage, and Azure RBAC data roles.