An automation script must give a partner temporary read access to one blob. Security policy forbids storing or using the storage account key in the script. The script runs under a managed identity that holds the Storage Blob Data Reader and Storage Blob Delegator roles. Which token should the script create?
Show answer and explanation
Answer: A
A user delegation SAS is signed with a user delegation key that Microsoft Entra ID issues to an authorized identity, so the script never needs the storage account key. The managed identity needs the delegator permission to request that key, plus the read role for the blob. Service and account SAS tokens are signed with the account key, which violates the policy even if the key is held in Key Vault. Stored access policies are defined on the container and must be created with key-based credentials, which the policy also forbids.
Why the other options are wrong
- B. A service SAS signed with the account key still depends on the storage account key. Storing that key in Key Vault protects it but does not satisfy a policy that forbids using the key.
- C. An account SAS is signed with the storage account key, so the policy is violated regardless of the one-hour expiry. Expiry limits the window of use but not the key dependency.
- D. A stored access policy is defined on a container and is used with service SAS tokens. Creating it through key-based credentials would require the account key, which the policy forbids.