AZ-104 Practice Question 64: Disable Shared Key User Delegation SAS
Microsoft Azure Administrator Associate (AZ-104) · Test 7 · question 4 of 10
A security policy states that storage account access keys must not be usable to authorize requests to a storage account. The company's web application still needs to hand out time-limited, read-only links to individual blobs, and it can authenticate to Microsoft Entra ID.
What should the administrator do?
Show answer and explanation
Answer:
When key access is disabled on the account, any request authorized with the account key, including SAS tokens that are signed with it, is rejected. A user delegation SAS is signed with a user delegation key that is obtained by using Microsoft Entra credentials, so it keeps working and can still grant limited, time-bound read access to a blob. The application authenticates with Entra ID (for example through a managed identity) and needs a role that allows it to request the delegation key.
Option B leaves the keys usable. Rotation shortens the exposure of a leaked key but the policy says the keys must not be usable at all.
Option C fails once key access is off. A service SAS, even when it references a stored access policy, is signed with the account key, so the requests are denied.
Option D also depends on the account key. An account SAS is signed with it, and leaving key access on breaks the policy however short the expiry is.
Reference: Prevent authorization with Shared Key