AZ104-Q: SAS vs access key
Q: An external app needs time-limited, least-privilege access to only the
invoicescontainer. What should you give it?
- A) The storage account access key
- B) The account connection string
- C) A full-access SAS
- D) A container-scoped SAS with a short expiry ✓
Answer: D. Grant a Shared Access Signature (SAS) scoped to that container with the minimum permissions (Read) and a short expiry. An access key or full connection string is equivalent to the account password (full control) — never share it. SAS provides scoped, time-bound access. For identity-based access, an even better option is Entra ID + RBAC (Storage Blob Data Reader).
Why it helps
Key vs SAS is a core AZ-104 distinction: access keys = full account keys, SAS = scoped/time-limited, always prefer least privilege.