A contractor needs to upload data into one specific blob container for six hours. The administrator must avoid sharing the storage account key and should grant only the minimum permissions needed. Which access method should be used?

The storage account access key, because it is easier to revoke later.

The account key grants broad access to the entire account and is not least privilege. It also creates unnecessary exposure for a temporary contractor task.

A shared key rotation policy, because it grants time-limited access to one container.

Rotating keys is a maintenance process, not an access method. It does not provide container-level scoping or time-limited contractor access.

A user-assigned managed identity assigned to the contractor’s laptop.

Managed identities are used for Azure resources, not for a contractor-owned laptop. They also would not automatically grant external temporary upload rights in this scenario.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A service SAS scoped to the container with write permission and an expiry time in six hours. — A service SAS is the best answer because it can be limited to one container, restricted to write operations, and configured with a short expiration time. That design follows least privilege and avoids distributing the storage account key. It is a common operational choice when external users need temporary, narrow access to blob data and the administrator wants the access to expire automatically. Why others are wrong: The storage account key gives far broader access than needed and is poor practice for a short-term contractor use case. Key rotation is not itself an access mechanism and does not scope permissions to one container. Managed identities are meant for Azure resources, not a contractor’s endpoint, so they are not the right option here.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.