Cascade Regional Airlines is bringing in an outside avionics inspection vendor to review photos of a recent landing-gear-door inspection stored in a single Blob container. Security wants the access credential tied to a specific Microsoft Entra ID identity rather than the storage account key, so it can be revoked by removing a role assignment instead of rotating keys. Which credential should IT issue to the vendor?
Select an answer to reveal the explanation.
Short Explanation
Think of it like signing a permission slip with your own name instead of a shared office stamp. A user delegation SAS is backed by an Microsoft Entra ID identity, so pulling that identity's role assignment kills the token instantly. No key rotation required, no other app's access disturbed.
Full Explanation
A user delegation SAS is requested by first obtaining a user delegation key from Microsoft Entra ID (via an RBAC role such as Storage Blob Data Reader), and that key — not the account key — signs the token. Because the token is tied to the requesting identity's role assignment, revoking that single assignment invalidates the token immediately, even before its expiry. An account SAS fails the scenario because it authorizes across the whole account and every service, far wider than one container of inspection photos. A service SAS signed with the account key ties the token's validity to the key itself — revoking it means rotating the key, which breaks every other application still using that key. Handing over the raw account key is worse still: it grants unrestricted read/write/delete across the entire account with no expiry and no way to scope it down. One operational caveat: a user delegation SAS can be valid for at most 7 days, so a longer engagement needs a fresh token issued periodically. To verify the setup, remove the vendor's role assignment and confirm the existing token now returns an authorization failure.