The lock-photo API on App Service still stores a SAS in application settings. What should the security engineer do instead?
Select an answer to reveal the explanation.
Short Explanation
Ditch the SAS sticky note in app settings. Give the app’s managed identity Storage Blob Data Contributor on that container and let Entra do the talking.
Full Explanation
When the caller is an Azure resource, preferred blob access uses a managed identity with a data-plane Azure role such as Storage Blob Data Contributor scoped to the container or account. That removes long-lived SAS secrets from configuration. Extending SAS lifetime or placing signatures in public content increases exposure. Subscription Owner is far broader than needed for blob reads and writes.