Azure SAS Token for Container-Level Time-Limited Access
A partner company needs to upload files to a single blob container for the next 24 hours. The partner should not receive the storage account key, and the access should be limited to that container only. Which access mechanism should you provide?
Quick Answer
The answer is a container-level SAS token with write permission and a 24-hour expiry. This is correct because a Shared Access Signature (SAS) token provides delegated, time-limited access to a specific Azure resource—here, a single blob container—without ever exposing the storage account key, which satisfies the partner’s need to upload files securely for only 24 hours. On the AZ-104 exam, this scenario tests your understanding of SAS token scope and permissions; a common trap is choosing a service-level SAS or account-level SAS, which grant broader access than intended. Remember that container-level SAS tokens are scoped to the container resource, and you must explicitly set the write permission (add/create) and the expiry window. Memory tip: “Container SAS, write pass, 24-hour glass”—if the requirement says “no key sharing” and “single container only,” always reach for a container-scoped SAS with a tight expiry.
⚠ Common exam trap
Candidates often confuse SAS tokens with storage account keys, thinking a key is simpler for external users, or mistakenly believe RBAC at a management group scope can be narrowed to a single container, when in fact RBAC for containers requires the scope to be the container itself (via Azure RBAC for Data Actions) and is not available at management group level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A container-level SAS token with write permission and a 24-hour expiry.
A container-level SAS token with write permission and a 24-hour expiry is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. The SAS token is generated with the container as the resource scope, write permission (add/create), and an expiry time of 24 hours, meeting all requirements: no key sharing, container-only access, and time-bound access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A container-level SAS token with write permission and a 24-hour expiry.
Why this is correct
A SAS token is the right tool for short-lived, scoped access to one container. It avoids sharing the storage account key, and you can limit the permissions to write only with a precise expiration time. That makes it well suited for partner uploads, temporary transfers, and other delegated storage tasks.
- ✗
The storage account key, because it is easier for external users to use.
Why it's wrong here
The account key grants broad access to the entire storage account and is not scoped to one container. It also exposes a long-lived secret unnecessarily.
When this WOULD be correct
A question where the requirement is to provide the partner with full access to the entire storage account (all containers, tables, queues) for an extended period, and security concerns about key exposure are not a factor, such as for a trusted internal team.
- ✗
A management group role assignment, because RBAC can restrict access to one blob container.
Why it's wrong here
Management group scope applies to governance and RBAC, but external partners do not need broad administrative permissions for this upload scenario. It is far too coarse for file transfer access.
When this WOULD be correct
A question requiring granting permissions to an entire management group (e.g., all subscriptions under it) for a specific role, such as 'Contributor' for a team managing resources across multiple subscriptions, would make this option correct.
- ✗
A private endpoint, because it grants the partner write access over a private IP.
Why it's wrong here
Private endpoints control network path, not user authorization. They do not grant file upload permissions by themselves.
When this WOULD be correct
A private endpoint would be correct if the question required secure, private connectivity to a storage account from a virtual network, without exposing it to the public internet, and the access mechanism was not the focus (e.g., 'Which network solution ensures traffic stays within Microsoft's backbone?').
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A container-level SAS token with write permission and a 24-hour expiry.Correct answer▾
Why this is correct
A SAS token is the right tool for short-lived, scoped access to one container. It avoids sharing the storage account key, and you can limit the permissions to write only with a precise expiration time. That makes it well suited for partner uploads, temporary transfers, and other delegated storage tasks.
✗The storage account key, because it is easier for external users to use.Wrong answer — click to see why▾
Why this is wrong here
The storage account key grants full administrative access to the entire storage account, not just a single container, violating the requirement to limit access to one container. It also exposes the key to the partner, which is prohibited.
★ When this WOULD be the correct answer
A question where the requirement is to provide the partner with full access to the entire storage account (all containers, tables, queues) for an extended period, and security concerns about key exposure are not a factor, such as for a trusted internal team.
Why candidates choose this
Candidates may think the storage account key is the simplest way to grant access, especially for external users, and overlook the security and scope limitations because they are familiar with using keys for authentication.
✗A management group role assignment, because RBAC can restrict access to one blob container.Wrong answer — click to see why▾
Why this is wrong here
RBAC roles at the management group scope apply to all subscriptions and resources under that group, not to a single blob container. To restrict access to one container, you would need a role assignment at the container scope, which is not possible with management groups.
★ When this WOULD be the correct answer
A question requiring granting permissions to an entire management group (e.g., all subscriptions under it) for a specific role, such as 'Contributor' for a team managing resources across multiple subscriptions, would make this option correct.
Why candidates choose this
Candidates may confuse management groups with resource groups or think RBAC can be finely scoped to a container via management groups, not realizing that RBAC scopes are hierarchical and management groups are too broad for container-level access.
✗A private endpoint, because it grants the partner write access over a private IP.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint does not grant write access or any permissions by itself; it only provides a private IP connection to the storage account. Access control is still managed via keys, SAS, or RBAC, and it does not limit access to a single container.
★ When this WOULD be the correct answer
A private endpoint would be correct if the question required secure, private connectivity to a storage account from a virtual network, without exposing it to the public internet, and the access mechanism was not the focus (e.g., 'Which network solution ensures traffic stays within Microsoft's backbone?').
Why candidates choose this
Candidates may confuse network-level isolation (private endpoint) with access control, thinking that a private IP inherently restricts access to a specific container, or they may overestimate the security benefits of private endpoints for fine-grained permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
SAS
SAS (Serial Attached SCSI) is a high-speed data transfer technology used to connect hard drives and SSDs in servers and enterprise storage systems.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A contractor must import data into one blob container for six hours. The contractor should not receive the storage account key, and access must be limited to that container only. Which credential should the administrator generate?
medium- A.A storage account access key, because it can be copied into the import tool.
- ✓ B.A user delegation SAS, because it is signed with Microsoft Entra credentials and is time limited.
- C.A shared key connection string, because it works with any tool that needs blob access.
- D.A managed identity token, because the contractor can use it outside Azure directly.
Why B: A user delegation SAS is signed with Microsoft Entra credentials (formerly Azure AD) and can be scoped to a specific blob container with a time limit. This meets the requirement of granting the contractor access only to that container for six hours without exposing the storage account key.
Variation 2. A contractor needs to upload data into one specific blob container for six hours. The administrator must avoid sharing the storage account key and should grant only the minimum permissions needed. Which access method should be used?
medium- ✓ A.A service SAS scoped to the container with write permission and an expiry time in six hours.
- B.The storage account access key, because it is easier to revoke later.
- C.A shared key rotation policy, because it grants time-limited access to one container.
- D.A user-assigned managed identity assigned to the contractor’s laptop.
Why A: A service SAS scoped to the container with write permission and an expiry time of six hours is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. This meets the requirement of granting only the minimum permissions needed (write) for the six-hour duration, and the SAS can be revoked by regenerating the storage account key if necessary.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.