Grant Temporary Blob Upload Access with a SAS Token
A contractor needs temporary access to upload files into one Azure Blob container for six hours. The administrator does not want to share the storage account key. What should the administrator create?
Quick Answer
The answer is a shared access signature (SAS) token scoped to the container with a six-hour expiration time. This is correct because a SAS token provides temporary, delegated access to specific Azure Blob Storage operations—such as uploads—without ever exposing the storage account key, which remains fully secure. By setting the expiration window to exactly six hours, the administrator grants time-limited access that automatically revokes itself, perfectly matching the requirement for temporary blob upload access. On the AZ-104 exam, this scenario tests your understanding of shared access signatures versus account keys or other access methods; a common trap is choosing to generate a SAS at the account level instead of the container level, which grants overly broad permissions. Remember the memory tip: “SAS is a time-limited key for a specific task—scope it down, time it out.”
⚠ Common exam trap
It's easy for candidates to confuse a SAS with a storage account key, thinking any shared credential is unsafe, or mistakenly choose a private endpoint as a security solution for access control rather than network isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A shared access signature scoped to the container and expiration time
A shared access signature (SAS) scoped to the container provides time-limited, delegated access to specific operations (e.g., upload) without exposing the storage account key. By setting an expiration time of six hours, the administrator ensures the contractor can upload files only during that window, after which the token becomes invalid. This meets the requirement for temporary, secure access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A shared access signature scoped to the container and expiration time
Why this is correct
A SAS can grant limited, time-bound access to a specific resource such as one container, without exposing the storage account key.
- ✗
A new storage account access key
Why it's wrong here
An access key grants broad account-level access and is much wider than the contractor needs.
When this WOULD be correct
If the question required granting full administrative access to a storage account for a trusted internal team member with no time restriction, sharing the access key would be appropriate.
- ✗
A management group assignment
Why it's wrong here
Management groups control governance over subscriptions, not temporary file upload access to blob storage.
When this WOULD be correct
An administrator needs to apply the same Azure Policy, such as requiring tags on all resources, to multiple subscriptions under a management group. Creating a management group assignment would enforce the policy across those subscriptions.
- ✗
A private endpoint for the contractor
Why it's wrong here
Private endpoints control network access paths, but they do not provide temporary user authorization by themselves.
When this WOULD be correct
An administrator needs to ensure that only traffic from a specific virtual network can access a storage account, while blocking all public internet access. In that case, creating a private endpoint would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A shared access signature scoped to the container and expiration timeCorrect answer▾
Why this is correct
A SAS can grant limited, time-bound access to a specific resource such as one container, without exposing the storage account key.
✗A new storage account access keyWrong answer — click to see why▾
Why this is wrong here
Sharing the storage account access key grants full access to all storage services and containers, which violates the requirement to limit access to a single container for a specific time period.
★ When this WOULD be the correct answer
If the question required granting full administrative access to a storage account for a trusted internal team member with no time restriction, sharing the access key would be appropriate.
Why candidates choose this
Candidates may think that any access key provides limited access, but they overlook that storage account keys grant unrestricted access to all data in the account.
✗A management group assignmentWrong answer — click to see why▾
Why this is wrong here
A management group assignment manages access and policies across multiple subscriptions, not temporary access to a single blob container. It does not provide time-limited, container-specific access.
★ When this WOULD be the correct answer
An administrator needs to apply the same Azure Policy, such as requiring tags on all resources, to multiple subscriptions under a management group. Creating a management group assignment would enforce the policy across those subscriptions.
Why candidates choose this
Candidates may confuse management groups with role assignments or think they can be used to grant granular access, but management groups are for organizing subscriptions and applying governance, not for direct data access.
✗A private endpoint for the contractorWrong answer — click to see why▾
Why this is wrong here
A private endpoint restricts network access to the storage account but does not provide temporary, scoped access to a specific container without sharing the account key.
★ When this WOULD be the correct answer
An administrator needs to ensure that only traffic from a specific virtual network can access a storage account, while blocking all public internet access. In that case, creating a private endpoint would be correct.
Why candidates choose this
Candidates may think a private endpoint provides secure, temporary access by isolating the storage account, but it does not grant time-limited permissions to a specific container.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Blob
A blob is a large piece of unstructured data, like a photo or video, stored in the cloud with a unique identifier.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A contractor needs temporary read-only access to a single blob container for three hours. The contractor does not have an Azure user account in your tenant. Which method is the best fit?
easy- A.Create a new managed identity for the contractor
- B.Give the contractor the storage account access key
- ✓ C.Issue a shared access signature with read-only permissions and an expiration time
- D.Enable anonymous public access on the container
Why C: A shared access signature (SAS) is the best fit because it provides time-limited, delegated access to a specific resource (a blob container) without requiring an Azure AD identity. The contractor can use the SAS URL to access the container with read-only permissions for exactly three hours, after which the token expires automatically. This meets the requirement of temporary access for an external user who does not have an Azure account in your tenant.
Variation 2. You need to grant an external partner temporary read access to a single blob in an Azure storage account without giving access to the account key. What should you create?
medium- A.A storage account access key
- ✓ B.A shared access signature (SAS)
- C.A resource lock
- D.A private endpoint
Why B: A shared access signature (SAS) is the correct solution because it provides delegated, time-limited access to a specific Azure storage resource (such as a single blob) without exposing the storage account key. You can configure the SAS with read-only permissions, an expiration time, and apply it to a specific blob URL, meeting the requirement for temporary external read access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.