Grant Temporary Write Access to a Blob Container with User Delegation SAS
A partner company needs write access to a single blob container for 24 hours. The partner does not have an Azure subscription in your tenant, and the team does not want to share the storage account key. Which access method is the best choice?
Quick Answer
The answer is to create a user delegation SAS with write permission and a short expiration time. This method is correct because a user delegation SAS is secured with Azure AD credentials rather than the storage account key, allowing you to grant temporary write access to a specific blob container without exposing the key. It supports fine-grained scoping and a configurable expiration window, which perfectly meets the 24-hour requirement while ensuring the partner—who lacks an Azure subscription in your tenant—can access only that container. On the AZ-104 exam, this scenario tests your understanding of shared access signatures versus user delegation SAS, with a common trap being to choose a service-level SAS or share the account key. Remember: user delegation SAS uses Azure AD, not keys, so it is the only option that avoids key exposure for cross-tenant, time-limited access. A helpful memory tip is “User delegation for users, key-based for services”—if the partner is a user without a subscription, always pick the delegation SAS.
⚠ Common exam trap
Many candidates confuse a user delegation SAS with a service SAS or account SAS, or mistakenly think that granting RBAC roles like Contributor is the simplest way to provide access, without realizing it grants far more permissions than needed and violates the principle of least privilege.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a user delegation SAS with write permission and a short expiration time
A user delegation SAS is the best choice because it provides time-limited, scoped write access to a specific blob container without exposing the storage account key. It is secured with Azure AD credentials and can be configured with a short expiration time (e.g., 24 hours), meeting the partner's requirement for temporary access. This method ensures the partner does not need an Azure subscription in your tenant and avoids sharing the account key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the partner Contributor access on the storage account
Why it's wrong here
Contributor is broader than needed and still requires the partner to have an identity in the tenant.
When this WOULD be correct
This option would be correct if the partner needed full management access to the storage account (e.g., to configure networking or monitoring) for an indefinite period, and the partner had an Azure subscription in the same tenant, allowing RBAC role assignment.
- ✓
Create a user delegation SAS with write permission and a short expiration time
Why this is correct
A user delegation SAS provides temporary access without exposing the storage account key and can be tightly scoped.
- ✗
Share the storage account access key and let the partner create their own token
Why it's wrong here
Sharing the account key exposes full secret material and defeats the requirement to avoid key distribution.
When this WOULD be correct
If the question required granting full access to the entire storage account for an indefinite period and the partner was fully trusted, sharing the access key might be acceptable, though still not best practice.
- ✗
Enable anonymous public write access on the container
Why it's wrong here
Anonymous write access is not a secure or controlled way to grant temporary partner access.
When this WOULD be correct
If the requirement were to allow anonymous read access to a container for public content (e.g., a static website), and write access is not needed, then enabling anonymous public read access would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a user delegation SAS with write permission and a short expiration timeCorrect answer▾
Why this is correct
A user delegation SAS provides temporary access without exposing the storage account key and can be tightly scoped.
✗Grant the partner Contributor access on the storage accountWrong answer — click to see why▾
Why this is wrong here
Granting Contributor access on the storage account gives the partner full control over the entire storage account, including all containers and blobs, and allows management operations like deleting the account. This exceeds the requirement of write access to a single container for only 24 hours and violates the principle of least privilege.
★ When this WOULD be the correct answer
This option would be correct if the partner needed full management access to the storage account (e.g., to configure networking or monitoring) for an indefinite period, and the partner had an Azure subscription in the same tenant, allowing RBAC role assignment.
Why candidates choose this
Candidates may think that Contributor access is a standard way to grant permissions in Azure and might overlook that it provides far more access than needed, especially for a temporary and scoped requirement.
✗Share the storage account access key and let the partner create their own tokenWrong answer — click to see why▾
Why this is wrong here
Sharing the storage account access key grants full administrative access to the entire storage account, not just the single container, and violates the requirement to not share the key.
★ When this WOULD be the correct answer
If the question required granting full access to the entire storage account for an indefinite period and the partner was fully trusted, sharing the access key might be acceptable, though still not best practice.
Why candidates choose this
Candidates may think sharing the key is simpler and still allows the partner to generate their own SAS, overlooking the security risk of exposing the key.
✗Enable anonymous public write access on the containerWrong answer — click to see why▾
Why this is wrong here
Enabling anonymous public write access on the container would allow anyone on the internet to write to the container, violating security requirements and providing uncontrolled access beyond the intended partner.
★ When this WOULD be the correct answer
If the requirement were to allow anonymous read access to a container for public content (e.g., a static website), and write access is not needed, then enabling anonymous public read access would be correct.
Why candidates choose this
Candidates may think anonymous access is simpler than SAS, or confuse public read scenarios with the write requirement, overlooking the severe security risk of public write.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Container
A container is a lightweight, standalone software package that includes everything needed to run an application, such as code, runtime, system tools, and libraries.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A partner organization needs write access to a single blob container for 24 hours. You want to avoid sharing the storage account key and minimize access scope. Which access mechanism should you provide?
medium- A.A storage account key
- ✓ B.A user delegation SAS
- C.A container stored access policy without a token
- D.An Azure Policy assignment
Why B: A user delegation SAS is the correct choice because it provides time-limited, delegated access to a specific blob container using Azure AD credentials, without exposing the storage account key. It allows you to grant write access for exactly 24 hours to a single container, minimizing the access scope as required.
Variation 2. A contractor needs temporary access to upload and download files in only one blob container for 8 hours. You do not want to share the storage account key, and you want to revoke access later without affecting other containers. What should you create?
medium- A.A storage account access key, because it can be limited to one container by policy.
- ✓ B.A container-level SAS token backed by a stored access policy, so you can limit and revoke access.
- C.Anonymous public access on the container, because it is the easiest way to time-limit access.
- D.Azure RBAC on the storage account only, because RBAC automatically expires after a few hours.
Why B: A container-level SAS token backed by a stored access policy is the correct solution because it allows you to grant temporary, scoped access to a single blob container without exposing the storage account key. The stored access policy enables you to revoke the SAS token at any time by modifying or deleting the policy, which immediately invalidates all tokens associated with it, without affecting other containers.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.