A hail-net vineyard web app must mint a SAS for browser uploads without placing the storage account key on the app. What should the developer create?
Select an answer to reveal the explanation.
Short Explanation
Don’t park the storage account key on the web app just to mint URLs. User-delegation SAS is Entra-signed—and that’s the type Microsoft recommends.
Full Explanation
A user-delegation SAS is signed using Microsoft Entra credentials via a user delegation key rather than the storage account key. Microsoft recommends this type to avoid distributing account keys to application hosts. The calling identity needs permission to generate a user delegation key (for example, through appropriate RBAC on the storage account).