AZ-104 Implement and Manage Storage Practice Question
A deployment pipeline uploads content to a blob container in Azure Storage. The pipeline authenticates with Microsoft Entra ID and must grant a partner temporary write access for 12 hours without sharing the storage account key. The access should be limited to the container only. Which access method should the administrator use?
⚠ Common exam trap
Candidates often confuse Account SAS with user delegation SAS, not realizing that Account SAS is signed with the storage account key and thus fails the 'no key sharing' requirement, while user delegation SAS uses Microsoft Entra ID for secure, keyless delegation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User delegation SAS
A user delegation SAS is the correct choice because it uses Microsoft Entra ID credentials to sign the SAS token, providing temporary, delegated access to a specific container without exposing the storage account key. It supports granular permissions and an expiration time of up to 12 hours, meeting the partner's write access requirement while limiting access to the container only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shared access key authentication
Why it's wrong here
Shared key authentication uses the storage account's primary or secondary key, which is an account-wide secret that grants full control over all services in the account, not just one container. Exposing this key to a partner for a pipeline upload would violate least privilege and risks compromise of the entire storage account. A time-limited, container-scoped token cannot be issued from a shared key without also revealing the key itself.
When this WOULD be correct
A scenario where the administrator needs to grant full access to the entire storage account (e.g., for bulk data migration) and trusts the partner with the account key, without requiring temporary or container-scoped access.
- ✗
Account SAS
Why it's wrong here
An account SAS is signed with the storage account key and is defined at the account level, even though you can restrict the signed resources and permissions. It relies on the shared key for validation, so it does not support Microsoft Entra identity-based authorization and still exposes the key to anyone who possesses the SAS. Because the SAS is generated from account-level secrets, it cannot provide the same least-privilege, identity-attributed access as a user delegation SAS scoped to a single container.
When this WOULD be correct
A question requiring access to multiple containers or services (e.g., blobs and queues) within a storage account for a limited time, where sharing the account key is acceptable and Entra ID delegation is not required.
- ✓
User delegation SAS
Why this is correct
User delegation SAS is generated by an identity authenticated with Microsoft Entra ID and does not require exposing the storage account key. It can be scoped tightly to the container, granted for a fixed time window, and limited to write operations. That makes it the best fit for temporary partner access.
- ✗
Service endpoint access with network rules only
Why it's wrong here
Service endpoint access with network rules only controls the source network (VNet or public IP range) from which requests can arrive; it does not authenticate the caller or grant any data-plane permissions. A partner would still need a credential or SAS token to upload blobs, and network rules cannot enforce a specific write operation or a time window. Therefore, this mechanism alone cannot satisfy the requirement for time-limited, container-scoped write access.
When this WOULD be correct
An organization needs to allow access to a storage account only from a specific virtual network (e.g., from an Azure VM) and deny all other traffic, without requiring any SAS or key. The question would specify that the access is for internal resources within a trusted network and does not involve external partners or temporary permissions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓User delegation SASCorrect answer▾
Why this is correct
User delegation SAS is generated by an identity authenticated with Microsoft Entra ID and does not require exposing the storage account key. It can be scoped tightly to the container, granted for a fixed time window, and limited to write operations. That makes it the best fit for temporary partner access.
✗Shared access key authenticationWrong answer — click to see why▾
Why this is wrong here
Shared access key authentication grants full access to the entire storage account, not limited to a single container, and exposes the account key, violating the requirement to avoid sharing the key.
★ When this WOULD be the correct answer
A scenario where the administrator needs to grant full access to the entire storage account (e.g., for bulk data migration) and trusts the partner with the account key, without requiring temporary or container-scoped access.
Why candidates choose this
Candidates may think shared access keys are the simplest method for granting access, overlooking the security and scope limitations specified in the question.
✗Account SASWrong answer — click to see why▾
Why this is wrong here
An Account SAS grants access to multiple services or the entire storage account, not limited to a single container, and does not support delegation via Microsoft Entra ID for temporary write access without sharing the account key.
★ When this WOULD be the correct answer
A question requiring access to multiple containers or services (e.g., blobs and queues) within a storage account for a limited time, where sharing the account key is acceptable and Entra ID delegation is not required.
Why candidates choose this
Candidates may confuse Account SAS with User Delegation SAS, thinking both provide container-level access, but Account SAS lacks the fine-grained scope and Entra ID integration needed for this scenario.
✗Service endpoint access with network rules onlyWrong answer — click to see why▾
Why this is wrong here
Service endpoint access with network rules only restricts traffic to a virtual network but does not provide temporary, time-limited write access to a specific container for an external partner. It lacks the granular delegation and expiration control needed for this scenario.
★ When this WOULD be the correct answer
An organization needs to allow access to a storage account only from a specific virtual network (e.g., from an Azure VM) and deny all other traffic, without requiring any SAS or key. The question would specify that the access is for internal resources within a trusted network and does not involve external partners or temporary permissions.
Why candidates choose this
Candidates may confuse network-level security with access delegation, thinking that restricting to a service endpoint provides sufficient control, or they may overlook the requirement for temporary, container-specific write access for an external partner.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
Container
A container is a lightweight, standalone software package that includes everything needed to run an application, such as code, runtime, system tools, and libraries.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.