AZ-104 Implement and Manage Storage Practice Question
Network Topology
Based on the exhibit, which method should the administrator use to grant the partner time-limited access to one container?
⚠ Common exam trap
Candidates often confuse a service SAS (which uses the storage account key and is easier to generate) with a user delegation SAS, not realizing that the user delegation SAS provides superior security and granularity for time-limited, container-scoped access without exposing the account key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate a user delegation SAS after authenticating with Microsoft Entra ID.
A user delegation SAS is secured with Microsoft Entra ID credentials and can be scoped to a specific container with a time-limited expiry, meeting the requirement for time-limited access to one container. Unlike a service SAS, which uses the storage account key and grants broader permissions, the user delegation SAS provides finer-grained control and does not expose the account key. This method is the recommended approach for granting delegated, time-bound access to Azure Storage resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate a service SAS by using the storage account key and email the URL to the partner.
Why it's wrong here
Generating a service SAS using the storage account key is invalid here because the exhibit disables shared key access, and the storage account key itself is a powerful secret that should never be distributed or used for temporary delegation. Even when shared keys are enabled, a service SAS carries the same permissions as the key unless carefully constrained, and emailing the SAS URL risks interception and reuse before expiry. In contrast, a user delegation SAS is signed with Microsoft Entra credentials and does not expose the account key.
When this WOULD be correct
If the question asked for granting access to a partner without requiring Microsoft Entra ID authentication, and the partner only needs access to a specific container for a limited time, a service SAS generated from the storage account key would be correct.
- ✓
Generate a user delegation SAS after authenticating with Microsoft Entra ID.
Why this is correct
A user delegation SAS is the safest temporary access method in this scenario because it does not require exposing the storage account key. It is signed with Microsoft Entra credentials, can be scoped to one container, and can be set to expire after six hours. That makes it easy to grant and revoke access while limiting permissions.
- ✗
Make the container public and remove the SAS requirement from the partner workflow.
Why it's wrong here
Making the container public would allow anonymous read access for anyone who can discover the blob URL, which cannot be limited to the partner or revoked after six hours. The exhibit requires a tightly controlled, temporary sharing window, but public access is persistent and offers no per-user auditing or expiration. Removing the SAS requirement entirely eliminates the ability to enforce scoped permissions, leaving the data exposed indefinitely.
When this WOULD be correct
If the question asked for the simplest method to allow public read access to a container for all users without authentication, making the container public would be correct.
- ✗
Assign the partner Storage Blob Data Contributor on the storage account and let them sign in interactively.
Why it's wrong here
RBAC can work for Azure identities, but this does not match a temporary external sharing scenario well. It also grants broader ongoing access than the exhibit requires and is not as convenient for a one-time access window.
When this WOULD be correct
This option would be correct if the question required granting a partner ongoing, full access to all blob data in the storage account without time constraints, and the partner could sign in interactively with their own identity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Generate a user delegation SAS after authenticating with Microsoft Entra ID.Correct answer▾
Why this is correct
A user delegation SAS is the safest temporary access method in this scenario because it does not require exposing the storage account key. It is signed with Microsoft Entra credentials, can be scoped to one container, and can be set to expire after six hours. That makes it easy to grant and revoke access while limiting permissions.
✗Generate a service SAS by using the storage account key and email the URL to the partner.Wrong answer — click to see why▾
Why this is wrong here
A service SAS generated from the storage account key does not support time-limited access with Microsoft Entra ID authentication, and it exposes the storage account key if the SAS is not properly scoped. The question requires a user delegation SAS for time-limited access to a single container.
★ When this WOULD be the correct answer
If the question asked for granting access to a partner without requiring Microsoft Entra ID authentication, and the partner only needs access to a specific container for a limited time, a service SAS generated from the storage account key would be correct.
Why candidates choose this
Candidates may think a service SAS is sufficient for time-limited access and overlook the requirement to use Microsoft Entra ID authentication, which is more secure and recommended for delegated access.
✗Make the container public and remove the SAS requirement from the partner workflow.Wrong answer — click to see why▾
Why this is wrong here
Making the container public would grant anonymous access to all users, violating the requirement for time-limited access to a specific partner.
★ When this WOULD be the correct answer
If the question asked for the simplest method to allow public read access to a container for all users without authentication, making the container public would be correct.
Why candidates choose this
Candidates might think making the container public is an easy way to grant access without managing SAS tokens, overlooking the need for time-limited and partner-specific access.
✗Assign the partner Storage Blob Data Contributor on the storage account and let them sign in interactively.Wrong answer — click to see why▾
Why this is wrong here
Assigning Storage Blob Data Contributor on the storage account grants permanent, broad access to all containers, not time-limited access to a single container as required.
★ When this WOULD be the correct answer
This option would be correct if the question required granting a partner ongoing, full access to all blob data in the storage account without time constraints, and the partner could sign in interactively with their own identity.
Why candidates choose this
Candidates may think RBAC roles are the standard way to grant access and overlook the specific requirements for time-limited and scoped access to a single container.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to allow a partner application to upload files to a blob container for the next 24 hours. The partner must not receive the storage account key. What should you provide?
hard- A.The storage account access key
- ✓ B.A shared access signature (SAS)
- C.The connection string with the account key
- D.A Recovery Services vault
Why B: A shared access signature (SAS) provides delegated, time-limited access to a specific Azure Storage resource (like a blob container) without exposing the storage account key. By generating a SAS token with write permissions and a 24-hour expiry, you grant the partner application the ability to upload files while maintaining security and control over the access window.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.