Scripts still call the lock-photo account with the account key even though identities already have Storage Blob Data roles. Which end-state access-control change should the security engineer make?
Select an answer to reveal the explanation.
Short Explanation
If everyone already has a real badge, take the skeleton key off the wall. Turn off Allow storage account key access so callers must use Entra or a user-delegation SAS.
Full Explanation
When Microsoft Entra data-plane access is in place, disabling shared key authorization blocks account-key and account-key-signed SAS authentication paths and forces Entra or user-delegation SAS. Account and service SAS signed with the account key stop working after the change, so applications must be migrated first. Key Vault key rotation for SSE CMK does not disable shared key authorization. Removing Entra assignments would move security backward.