A contractor treats a storage account access key as a read-only password for lock photos. What should the security engineer emphasize?
Select an answer to reveal the explanation.
Short Explanation
That “read-only password” is really the master till key—either key runs the data plane. Rotate it now and move folks to Entra roles.
Full Explanation
A storage account access key authenticates as the account for data-plane operations the key authorizes across supported services; it is not a read-only credential and is not limited to portal UI. Key1 and key2 are interchangeable peer keys, not read versus write. Keys do not behave like short-lived user-delegation SAS tokens. After exposure, regenerate the key and migrate callers to Microsoft Entra ID with data-plane RBAC where possible.