An external client needs temporary read access to one Blob and the organization prefers Entra-based delegation over sharing account keys. Which design fits?

Choose the single best answer.

A.A least-privilege short-lived user delegation SAS using a key obtained with Entra credentials
B.A service SAS that is claimed to be Entra-signed without an account key
C.An account key emailed to the client for all containers
D.A management Contributor role as a public unauthenticated Blob URL

Show the answer and explanation

✓ Correct answer

A least-privilege short-lived user delegation SAS using a key obtained with Entra credentials

User delegation SAS offers supported Entra-derived signing with scoped bearer access. Account keys grant broad sensitive capability; service SAS uses an account key. Management Contributor is not an anonymous object access token. Source guide: PDF page 29.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.