Quartz 5

storage-access-keys

Properties2
tagsstorage, security, access-keys, authentication, az-104
aliasesaccess keys, account keys, connection string, shared key auth

2 min read

Storage access keys & connection strings

What it is

Each storage account has two 512-bit access keys: key1 and key2. A key authorizes broad access to the account’s storage data and can create account-key-signed SAS tokens. Software can use a key through Shared Key authorization or a connection string.

Why it exists

Keys support applications and tools that still need Shared Key authorization. Two independent keys make a planned rotation possible: clients move to the unused key before the current key is regenerated.

Key ideas

  • A connection string is a credential container — it commonly contains the account name, key, and endpoint information. Treat the whole string as secret.
  • Regenerating a key immediately invalidates that key. Update every dependent client to the other working key before regenerating the current one; then update clients to the newly regenerated key and regenerate the second key.
  • Account-key-signed SAS is affected too. Regenerating the signing key invalidates service SAS and account SAS made with that key. It does not invalidate a user delegation SAS.
  • Prefer identity-based access where supported. Microsoft Entra ID plus data-plane RBAC and managed identities avoids distributing an account key. You can also disallow Shared Key authorization after testing the workloads that rely on it.

Northwind example

Northwind discovers an old integration using key1. Maya changes that integration to key2 and verifies it works, then regenerates key1. She switches the integration to the new key1, verifies it again, and only then regenerates key2. If a client used a SAS signed with the regenerated key, it must receive a replacement SAS.

How it fits (diagram)

Exam notes

  • Two keys enable a staged rotation, but clients must be changed and tested.
  • Keys are broad credentials; use Entra ID and data-plane RBAC where possible.
  • Regenerating an account key invalidates service and account SAS signed with it, not user delegation SAS.

storage-account · sas-token · storage-network-rule · rbac · entraid

📘 Source: Microsoft Learn — Storage Access Keys

Graph View

Backlinks