A mobile backend issues short-lived download links for private blobs. Your security team has banned storing account keys in application configuration. Which signing approach satisfies this rule?
Show answer and explanation
Answer: A
A user delegation SAS is signed with a user delegation key that the storage service issues to an identity authenticated by Microsoft Entra ID, such as a managed identity with the Storage Blob Delegator role. No storage account key is needed to sign or distribute the token, which satisfies the security rule. The token is still bounded by permissions and expiry, and it applies to Blob and Data Lake Storage operations. Removing the delegator role stops new delegation keys from being issued, though tokens already created remain valid until they expire.
Why the other options are wrong
- B. An account SAS is signed with an account key, which is exactly what the security team has banned. Keeping it in an app setting still stores a powerful shared secret where it can leak.
- C. A service SAS is still signed with an account key, so the shared secret the security team banned stays in the signing path even if it is rotated weekly.
- D. Embedding the account name and key hands the full storage key to anyone who can read the app's configuration or binary. It is the pattern the security team wants eliminated.