A legacy application still authenticates to Azure Blob Storage by using the account key. Security now requires preventing any new requests that use shared key authorization, while leaving the storage account itself and Microsoft Entra-based access unchanged. Which setting should the administrator enable?

Rotate the storage account keys every 24 hours

Frequent rotation does not stop shared key authorization; it only changes the secrets in use.

Require secure transfer for the storage account

HTTPS-only improves transport security, but it does not disable account-key authentication.

Create a private endpoint for the storage account

Private networking changes the path to storage, but it does not stop shared key authentication.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Disable shared key access on the storage account — Disabling shared key access is the control that stops new requests authenticated with the storage account key. It directly addresses the requirement to block shared key authorization while preserving other access methods such as Microsoft Entra-based authentication. This is a stronger control than rotating keys or tightening transport settings because it removes the authentication path itself rather than merely changing or protecting the secret. Why others are wrong: Rotating keys changes the secret but does not eliminate shared key authentication. Requiring secure transfer only enforces HTTPS and does not affect how the request is authenticated. Creating a private endpoint changes network reachability, but a client using the account key could still authenticate through that private path. The requirement is specifically to disable shared key authorization, not just to harden transport or routing.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.