A service should read blobs through Entra authentication but must not modify them. Which role concept fits?

1. An appropriately scoped Storage Blob Data Reader assignment
2. User Access Administrator as the blob-reader role
3. Subscription Owner by default
4. Network Contributor