A partner needs time-boxed read access to one lock-photo container, and the team was about to sign an account SAS with the storage account key. What should the security engineer mint instead?
Select an answer to reveal the explanation.
Short Explanation
Don’t ink the partner pass with the master account key. Mint a user-delegation SAS—Entra signs it, you scope the container and the clock, and the account key stays home.
Full Explanation
A user-delegation SAS is secured with Microsoft Entra ID credentials rather than the account key, which avoids distributing key material and aligns with identity-based control. Scope should match the container and permissions required for the partner window. Account SAS and service SAS signed with the account key inherit key-compromise risk. Embedding the raw account key provides standing full data-plane power.