Match each access requirement to the most appropriate Azure Storage authentication or authorization approach.
Drag a concept onto its matching description — or click a concept then click the description.
Enable a managed identity on the VM and assign a data-plane RBAC role
User delegation SAS
Storage account key
Azure RBAC data role assignment
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
SAS: Provides time-limited delegated access with specified permissions.
SAS provides delegated access; Azure AD authentication uses identity; public access allows anonymous reads; RBAC controls permissions; Azure AD DS extends on-prem AD; Service SAS can include IP restrictions.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
SAS: Provides time-limited delegated access with specified permissions.
Why this is correct
A Shared Access Signature (SAS) is a cryptographically signed URI that grants time-limited, delegated access to specific Azure Storage resources without exposing the storage account key. You can specify allowed permissions (e.g., read, write, delete, list) and a validity window, making it suitable for sharing temporary access. The token is signed with either the account key or a user-delegation key derived from Azure AD, and it is validated by the service for each request.
Azure AD authentication: Uses Azure AD identities to authenticate users and applications.
Why this is correct
Azure AD authentication signs the request with an OAuth 2.0 access token obtained by the user or application after authenticating to Azure AD. This method supports Azure AD identities, service principals, and managed identities, and integrates with RBAC to authorize actions. It is the recommended alternative to Shared Key authorization because it enables conditional access, MFA, and auditing.
Public access: Allows anonymous read access to containers and blobs.
Why this is correct
Public access is a container/account-level setting that allows any unauthenticated client to issue read requests to blobs or container metadata. It can be configured as 'Blob' (anonymous read only for blobs) or 'Container' (anonymous read plus list of blobs). Because no identity or token is presented, this access is anonymous and is typically used for immutable, universally accessible content such as web assets.
RBAC: Assigns granular permissions to Azure AD users, groups, or apps.
Why this is correct
RBAC grants permissions via role assignments to users, groups, or apps in Azure AD, with built-in roles such as Storage Blob Data Owner/Reader/Contributor. Roles can be scoped to a management group, subscription, resource group, storage account, or an individual container/queue. RBAC is the primary authorization mechanism for Azure AD-authenticated requests, meaning the request must first be authenticated via Azure AD.
SAS: Uses Azure AD identities to authenticate.
Why it's wrong here
This is a misconception: SAS tokens do not authenticate an identity. Instead, a SAS carries a signed token that authorizes anonymous bearer access (the token itself is the key), and it is usually signed with the storage account key or a user-delegation key. While a user-delegation SAS is created using an Azure AD identity's key, the SAS token does not contain the identity's credentials and does not perform authentication.
Azure AD authentication: Provides anonymous read access.
Why it's wrong here
Azure AD authentication requires a valid OAuth 2.0 token from Azure AD; it is necessarily authenticated and never anonymous. Anonymous read access is achieved only when public access is enabled on the container and the request presents no credentials. Since Azure AD authentication involves a token in the Authorization header, it is the antithesis of anonymous access.
Quick reference
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Learn chapter
Privileged Identity Management (PIM)
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.