User Delegation SAS: The Best Way to Grant Temporary Blob Access Without Sharing Keys
A contractor needs to upload files to one blob container for the next two hours. The contractor must not learn the storage account key, and access should expire automatically without manual cleanup. What is the best way to grant access?
Quick Answer
The answer is to generate a user delegation SAS from Entra ID with only the required container permissions and a two-hour expiry. This is correct because a user delegation SAS is signed with Entra ID credentials instead of the storage account key, so the contractor never learns the key, and the SAS can be scoped to a single container with precise permissions and a hard expiration, ensuring access expires automatically without manual cleanup. On the AZ-104 exam, this scenario tests your understanding of shared access signatures and the principle of least privilege, often appearing as a trap where candidates mistakenly choose a service SAS or a stored access policy, which still rely on the account key. A common memory tip is to remember that “user delegation” means “user identity from Entra ID,” so if the question says “no key sharing,” think “user delegation SAS.”
⚠ Common exam trap
It's easy for candidates to confuse an account SAS (which still uses the storage account key) with a user delegation SAS (which uses Entra ID), leading them to choose Option B because they think any SAS automatically avoids key exposure, but only the user delegation SAS truly prevents the contractor from learning the key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate a user delegation SAS from Entra ID with only the required container permissions and a two-hour expiry.
A user delegation SAS is the correct choice because it is secured with Entra ID credentials rather than the storage account key, ensuring the contractor never learns the key. The SAS can be scoped to exactly the required container permissions and a two-hour expiry, providing automatic, time-limited access without manual cleanup. This approach aligns with the principle of least privilege and eliminates the need to share or rotate storage account keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Share the storage account key and ask the contractor to stop using it after two hours.
Why it's wrong here
A storage account key is a long-lived secret that grants very broad access. It does not expire automatically after two hours, and manual cleanup is easy to miss. This approach is much less secure than a scoped temporary SAS.
When this WOULD be correct
If the question required granting full, permanent access to the storage account to a trusted administrator who needs to manage all resources, and automatic expiry is not needed, sharing the storage account key would be appropriate.
- ✗
Create an account SAS with broad permissions and send it to the contractor by email.
Why it's wrong here
An account SAS is still a shared secret and can be broader than necessary. It is better than a storage key, but it is not the most secure choice when Entra ID is available. It also does not give the least-privilege, identity-based control described in the scenario.
When this WOULD be correct
A question where a user needs temporary access to multiple blobs or containers for a short period, and the storage account key is already known to the administrator but must not be shared. The SAS is generated with a short expiry and sent via email, with no requirement for Entra ID integration or delegation.
- ✓
Generate a user delegation SAS from Entra ID with only the required container permissions and a two-hour expiry.
Why this is correct
A user delegation SAS is generated from Entra ID credentials, so the administrator does not expose the storage account key. It can be scoped to a single container, limited to upload permissions, and given a short expiration time. That combination satisfies least privilege and automatic expiration for temporary contractor access.
- ✗
Assign the contractor the Storage Blob Data Contributor role at the storage account scope.
Why it's wrong here
RBAC is a valid authorization model, but it does not automatically expire after two hours. The administrator would need to remove the role assignment manually later. The scenario specifically asks for access that expires automatically, which makes a temporary SAS the better fit.
When this WOULD be correct
This option would be correct if the question required granting long-term, revocable access to a contractor who needs to manage blobs (read, write, delete) for an extended period, and the organization uses Azure RBAC for access control with a process to remove the role assignment when no longer needed.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Generate a user delegation SAS from Entra ID with only the required container permissions and a two-hour expiry.Correct answer▾
Why this is correct
A user delegation SAS is generated from Entra ID credentials, so the administrator does not expose the storage account key. It can be scoped to a single container, limited to upload permissions, and given a short expiration time. That combination satisfies least privilege and automatic expiration for temporary contractor access.
✗Share the storage account key and ask the contractor to stop using it after two hours.Wrong answer — click to see why▾
Why this is wrong here
Sharing the storage account key grants full access to the entire storage account, not just the container, and does not automatically expire after two hours, violating the requirement for automatic expiry and limited access.
★ When this WOULD be the correct answer
If the question required granting full, permanent access to the storage account to a trusted administrator who needs to manage all resources, and automatic expiry is not needed, sharing the storage account key would be appropriate.
Why candidates choose this
Candidates may think sharing the key is the simplest method and assume the contractor will stop using it after two hours, overlooking the lack of automatic expiry and the security risk of exposing the key.
✗Create an account SAS with broad permissions and send it to the contractor by email.Wrong answer — click to see why▾
Why this is wrong here
An account SAS grants broad permissions (e.g., all containers) and does not automatically expire within two hours unless explicitly set; it also does not prevent the contractor from learning the storage account key because the SAS is derived from the key. The requirement for automatic expiry and no key exposure is not fully met.
★ When this WOULD be the correct answer
A question where a user needs temporary access to multiple blobs or containers for a short period, and the storage account key is already known to the administrator but must not be shared. The SAS is generated with a short expiry and sent via email, with no requirement for Entra ID integration or delegation.
Why candidates choose this
Candidates may think a SAS is always the best for temporary access, overlooking that an account SAS is tied to the storage account key and offers less granular control than a user delegation SAS. They might also assume email delivery is acceptable without considering security best practices.
✗Assign the contractor the Storage Blob Data Contributor role at the storage account scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Storage Blob Data Contributor role at the storage account scope does not provide automatic expiry; access would persist until manually revoked, violating the requirement that access expire automatically without manual cleanup.
★ When this WOULD be the correct answer
This option would be correct if the question required granting long-term, revocable access to a contractor who needs to manage blobs (read, write, delete) for an extended period, and the organization uses Azure RBAC for access control with a process to remove the role assignment when no longer needed.
Why candidates choose this
Candidates may think that Azure RBAC is always the best practice for access control and overlook the specific requirement for automatic expiry, assuming that the role assignment can be removed later, but the question explicitly demands automatic expiration without manual cleanup.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Container
A container is a lightweight, standalone software package that includes everything needed to run an application, such as code, runtime, system tools, and libraries.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A records team stores monthly regulatory exports in a blob container. The files are rarely opened, but auditors may request one specific file later the same day. The team wants the lowest storage cost possible while keeping a path to restore a single file on demand. Which approach should you use?
hard- A.Keep the blobs in the Hot tier and rely on lifecycle rules to delete them after 90 days.
- ✓ B.Move the blobs to the Archive tier and use high-priority rehydration when a file is requested.
- C.Move the blobs to the Cool tier because it is offline until accessed.
- D.Use the Cold tier because it requires a rehydration job before the blob becomes readable.
Why B: The Archive tier offers the lowest storage cost for rarely accessed data, and high-priority rehydration allows a single file to be restored within approximately one hour, meeting the auditor's same-day request requirement. This approach minimizes cost while retaining the ability to retrieve a specific file on demand.
Variation 2. A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key. Which two temporary access methods can be used? Select two.
easy- ✓ A.Service SAS, because it grants scoped access to a container or blob for a limited time.
- ✓ B.User delegation SAS, because it is issued with Microsoft Entra ID and supports limited-time access.
- C.Storage account shared key, because it can be time-limited when copied into an email.
- D.Anonymous access, because it can be enabled for the container and expires automatically after 12 hours.
- E.Resource lock, because it can restrict the partner to one container without requiring any token.
Why A: A Service SAS (Shared Access Signature) allows you to delegate limited-time, scoped access to a specific container or blob without exposing the storage account key. It can be configured with a start time, expiry time, and permissions (e.g., write, read), making it ideal for a 12-hour upload window. This method ensures the partner can only access the designated container for the required duration. B User delegation SAS is also a valid temporary access method: it is issued with Microsoft Entra ID (Azure AD) and provides scoped, time-limited access to a container or blob without sharing the storage account key. The user delegation SAS is signed with the user's credentials rather than the account key, offering a more secure option for temporary access.
Variation 3. A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key, and the access should expire automatically. Which access method should you use?
easy- A.Role assignment in Azure RBAC
- ✓ B.Shared access signature (SAS)
- C.Private endpoint
- D.Storage account lock
Why B: A shared access signature (SAS) is the correct choice because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. You can set an expiry time of 12 hours, and the SAS token can be generated with only the permissions needed (e.g., write). Once the token expires, access is automatically revoked, meeting the requirement for automatic expiration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.