Match each access requirement to the most appropriate Azure Storage authentication or authorization approach.
Drag a concept onto its matching description — or click a concept then click the description.
Enable a managed identity on the VM and assign a data-plane RBAC role
User delegation SAS
Storage account key
Azure RBAC data role assignment
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
SAS: Provides time-limited delegated access with specified permissions.
SAS provides delegated access; Microsoft Entra ID authentication uses identity; public access allows anonymous reads; RBAC controls permissions; Microsoft Entra Domain Services extends on-prem AD; Service SAS can include IP restrictions.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
SAS: Provides time-limited delegated access with specified permissions.
Why this is correct
A Shared Access Signature (SAS) is a cryptographically signed URI that grants time-limited, delegated access to specific Azure Storage resources without exposing the storage account key. You can specify allowed permissions (e.g., read, write, delete, list) and a validity window, making it suitable for sharing temporary access. The token is signed with either the account key or a user-delegation key derived from Microsoft Entra ID, and it is validated by the service for each request.
Microsoft Entra ID authentication: Uses Microsoft Entra ID identities to authenticate users and applications.
Why this is correct
Microsoft Entra ID authentication signs the request with an OAuth 2.0 access token obtained by the user or application after authenticating to Microsoft Entra ID. This method supports Microsoft Entra ID identities, service principals, and managed identities, and integrates with RBAC to authorize actions. It is the recommended alternative to Shared Key authorization because it enables conditional access, MFA, and auditing.
Public access: Allows anonymous read access to containers and blobs.
Why this is correct
Public access is a container/account-level setting that allows any unauthenticated client to issue read requests to blobs or container metadata. It can be configured as 'Blob' (anonymous read only for blobs) or 'Container' (anonymous read plus list of blobs). Because no identity or token is presented, this access is anonymous and is typically used for immutable, universally accessible content such as web assets.
RBAC: Assigns granular permissions to Microsoft Entra ID users, groups, or apps.
Why this is correct
RBAC grants permissions via role assignments to users, groups, or apps in Microsoft Entra ID, with built-in roles such as Storage Blob Data Owner/Reader/Contributor. Roles can be scoped to a management group, subscription, resource group, storage account, or an individual container/queue. RBAC is the primary authorization mechanism for Microsoft Entra ID-authenticated requests, meaning the request must first be authenticated via Microsoft Entra ID.
SAS: Uses Microsoft Entra ID identities to authenticate.
Why it's wrong here
This is a misconception: SAS tokens do not authenticate an identity. Instead, a SAS carries a signed token that authorizes anonymous bearer access (the token itself is the key), and it is usually signed with the storage account key or a user-delegation key. While a user-delegation SAS is created using an Microsoft Entra ID identity's key, the SAS token does not contain the identity's credentials and does not perform authentication.
Microsoft Entra ID authentication: Provides anonymous read access.
Why it's wrong here
Microsoft Entra ID authentication requires a valid OAuth 2.0 token from Microsoft Entra ID; it is necessarily authenticated and never anonymous. Anonymous read access is achieved only when public access is enabled on the container and the request presents no credentials. Since Microsoft Entra ID authentication involves a token in the Authorization header, it is the antithesis of anonymous access.
Quick reference
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,053 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.