A web app already reads blobs by using a managed identity. Security now requires blocking any future requests that use shared key authorization, while the app must continue to work without storing secrets. Which two changes should the administrator make? Select two.

Replace the managed identity with a storage account key in the app settings.

Using a storage account key would violate the requirement to avoid secrets and would re-enable shared-key dependence.

Remove all network rules from the storage account.

Network rules affect reachability, not authentication method, so they do not block shared key authorization.

Create a service SAS and embed it in the code.

A service SAS still relies on shared key infrastructure and is not aligned with the goal of removing secret-based access.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Disable shared key access on the storage account. — The app already uses managed identity, so the administrator can safely remove shared key authorization from the storage account. However, the identity must retain a suitable data-plane role such as Storage Blob Data Reader so it can keep reading blobs after the change. This combination blocks future key-based requests while preserving secretless application access through Microsoft Entra ID and RBAC. Why others are wrong: Switching back to a storage key reintroduces a secret. Network rules do not control authentication method, only source reachability. A service SAS still depends on key-based authorization, so it conflicts with the requirement to eliminate shared-key usage.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.