A user has Contributor on a storage account but cannot read blobs through Entra authentication. What is the most appropriate additional role for read-only blob access?

1. Reader on the resource group
2. Network Contributor
3. Storage Blob Data Reader
4. User Access Administrator without a data role