A deployment pipeline uploads content to a blob container in Azure Storage. The pipeline authenticates with Microsoft Entra ID and must grant a partner temporary write access for 12 hours without sharing the storage account key. The access should be limited to the container only. Which access method should the administrator use?

Shared access key authentication

Shared keys grant broad access to the account and are not limited to a single container.

Account SAS

Account SAS is broader than necessary and still depends on the storage account key.

Service endpoint access with network rules only

Network rules control where traffic can originate, but they do not grant the partner time-limited write permissions.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: User delegation SAS — User delegation SAS is the best choice because it is built from Microsoft Entra ID authentication rather than the storage account key. It can be constrained to one container, limited to write permissions, and set to expire after 12 hours. This gives the partner precise temporary access while avoiding the security and operational burden of sharing a key. Why others are wrong: Shared keys are too broad and violate the requirement to avoid sharing the account key. Account SAS also relies on the key and is not the best least-privilege choice. Network rules only control connectivity and cannot express a 12-hour write grant. The scenario calls for a time-limited authorization token, which is exactly what user delegation SAS provides.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.