Question 68 of 1,049
AZ-104 Implement and Manage Storage Practice Question
A partner organization needs write access to a single blob container for 24 hours. You want to avoid sharing the storage account key and minimize access scope. Which access mechanism should you provide?
⚠ Common exam trap
Test-takers frequently confuse a user delegation SAS with a service SAS or account SAS, but the key distinction is that a user delegation SAS uses Azure AD for signing, avoiding the need to share the storage account key while still providing scoped, time-limited access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A user delegation SAS
A user delegation SAS is the correct choice because it provides time-limited, delegated access to a specific blob container using Azure AD credentials, without exposing the storage account key. It allows you to grant write access for exactly 24 hours to a single container, minimizing the access scope as required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A storage account key
Why it's wrong here
A storage account key is a shared secret that acts as an account-level bearer credential, granting full administrative access to all blobs, tables, queues, and files in the storage account. Handing it to a partner would violate least privilege because it cannot be scoped to a single blob or to write-only permissions. Additionally, if the key is ever exposed or rotated, every application using it is affected, whereas a SAS token can be scoped and expire automatically.
When this WOULD be correct
A storage account key would be correct if the question asked for full administrative access to all storage resources for a trusted internal team, with no need to limit scope or duration.
- ✓
A user delegation SAS
Why this is correct
A user delegation SAS is the least-privilege option because it is signed with Azure AD credentials rather than a shared key, and its scope can be restricted to a single blob with only the write permission. You can also set a short expiration time and optionally restrict the client IP so the partner has exactly the access needed and no more. This is the only option that provides a concrete, revocable data-plane credential that satisfies the requirement.
- ✗
A container stored access policy without a token
Why it's wrong here
A stored access policy is only a set of constraints—such as permissions and start/expiry times—that is stored on the container and referenced by a SAS token. Without a SAS token signed with either an account key or a user delegation key, the policy alone provides no credential and therefore no access at all. Even if a policy exists, a partner attempting a write request with no token would be rejected by the storage service.
When this WOULD be correct
A container stored access policy would be correct if the question required defining access permissions and constraints (e.g., expiry time, permissions) for multiple SAS tokens without embedding them in the token itself, allowing revocation by modifying the policy.
- ✗
An Azure Policy assignment
Why it's wrong here
An Azure Policy assignment is a governance and compliance tool that applies rules for resource configuration, such as enforcing HTTPS or disallowing public blob access. It operates at the Azure Resource Manager control plane and does not issue credentials nor participate in data-plane authorization for individual blobs. Therefore it can never be used to grant a partner write access to a specific blob.
When this WOULD be correct
An Azure Policy assignment would be correct if the question asked how to enforce that all storage accounts in a subscription must use HTTPS only, or to audit storage accounts that do not have network restrictions enabled.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A user delegation SASCorrect answer▾
Why this is correct
A user delegation SAS is the least-privilege option because it is signed with Azure AD credentials rather than a shared key, and its scope can be restricted to a single blob with only the write permission. You can also set a short expiration time and optionally restrict the client IP so the partner has exactly the access needed and no more. This is the only option that provides a concrete, revocable data-plane credential that satisfies the requirement.
✗A storage account keyWrong answer — click to see why▾
Why this is wrong here
Sharing the storage account key grants full access to all storage account resources, including all containers and blobs, with no time or permission restrictions. This violates the requirement to minimize access scope and avoid sharing the key.
★ When this WOULD be the correct answer
A storage account key would be correct if the question asked for full administrative access to all storage resources for a trusted internal team, with no need to limit scope or duration.
Why candidates choose this
Candidates may default to using a storage account key because it is a familiar and simple method for granting access, without considering the need for scoped, temporary permissions.
✗A container stored access policy without a tokenWrong answer — click to see why▾
Why this is wrong here
A container stored access policy without a token does not provide any access; it only defines constraints. To grant access, a SAS token must be generated and attached to the policy, which is not done here.
★ When this WOULD be the correct answer
A container stored access policy would be correct if the question required defining access permissions and constraints (e.g., expiry time, permissions) for multiple SAS tokens without embedding them in the token itself, allowing revocation by modifying the policy.
Why candidates choose this
Candidates may think a stored access policy alone grants access, confusing the policy definition with the actual access token, or believe it minimizes scope without realizing a token is still needed.
✗An Azure Policy assignmentWrong answer — click to see why▾
Why this is wrong here
Azure Policy assignments enforce compliance rules across resources but do not grant direct write access to a blob container. They cannot provide time-limited, scoped access to a specific container.
★ When this WOULD be the correct answer
An Azure Policy assignment would be correct if the question asked how to enforce that all storage accounts in a subscription must use HTTPS only, or to audit storage accounts that do not have network restrictions enabled.
Why candidates choose this
Candidates may confuse Azure Policy with RBAC or SAS, thinking it can grant permissions, or they may overestimate Policy's ability to control data access at the container level.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.