Pass Your Microsoft AZ-104 Exam Easy!

A Blob Data Reader role authorizes a principal for particular data-plane reads, but it does not open a storage account firewall or classify the principal as a trusted Azure service. The request says a critical Azure service must get through restrictive network rules, and the administrator is considering a special firewall exception. Verify that this specific service and operation are actually listed as eligible for the trusted-services exception, then separately validate identity authorization. A broad data role alone leaves a blocked network route unchanged and increases privilege without fixing it.

Service endpoints identify permitted subnets for storage firewall virtual-network rules; they do not classify every Azure service as eligible for the trusted-services bypass setting. Applying an endpoint on a subnet unrelated to the caller cannot authorize the caller's actual network path. The case is specifically about checking whether a critical Azure service qualifies for a trusted Azure services firewall exception before permitting broader access. Confirm that exact service and operation on the documented list, or design a verified private/network path; do not substitute a generic endpoint on another subnet for a supported exception.

Trusted-services exceptions are scoped to documented Azure service scenarios rather than every workload in a subscription. Adding a broad conceptual subscription exception does not establish a supported network path for the calling service, and it undermines the restrictive firewall requirement. The first decision in this scenario is eligibility: identify the exact service identity and the storage operation and confirm the current trusted Azure services matrix. Only then consider a supported narrow network exception and the separate Blob DataActions required by the application.

A Storage service endpoint is used to identify selected Azure virtual-network subnets when they access supported storage public endpoints. It is not the right firewall identifier for the corporate workstation described here, whose traffic leaves an on-premises site through a NAT gateway. The IP rule on an Azure Storage account must evaluate the internet-facing source address seen by Storage, rather than the private address assigned inside the office. Determine the corporate egress NAT IP with the network team; then permit only the necessary public range while still enforcing SAS or Entra authorization.

A storage Private Endpoint and associated DNS could be a valid private connectivity redesign if the company has suitable ExpressRoute, VPN or other approved private path to the Azure virtual network. The scenario instead asks which source address matters for an existing storage public-endpoint IP firewall rule. Deploying a Private Endpoint would change the routing and name-resolution design, not explain why the current on-premises private workstation address fails to match a public IP rule. Identify the actual internet-facing NAT source IP used on that path before editing a public-endpoint firewall configuration.

Checking service endpoints, Private Link routes and data permissions is useful when an Azure virtual-network client cannot reach storage. This user is described as an on-premises workstation going through corporate NAT and the question specifically asks about an IP firewall rule. A subnet service endpoint does not cause the storage firewall to recognize the user's private workstation IP. First establish which public NAT address actually leaves the enterprise boundary; only then can the narrowly scoped public IP network rule be assessed. Keep identity-based data authorization as a separate security decision after the firewall path succeeds.

'Grant subscription Owner without checking the storage network path' fails the stated scenario where an approved VM subnet receives storage 403 responses after a network change because elevated RBAC cannot open a connection blocked by storage firewall and subnet routing. The required multi-part resolution instead needs path allowlisting and data authorization are separate prerequisites; a correct subnet rule alone may not grant content rights, which 'Grant subscription Owner without checking the storage network path' does not establish. Do not count 'Grant subscription Owner without checking the storage network path' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Disable all storage firewall rules as a permanent workaround' fails the stated scenario where an approved VM subnet receives storage 403 responses after a network change because removing restrictions would grant excessive network reachability and obscure the original denied path. The required multi-part resolution instead needs path allowlisting and data authorization are separate prerequisites; a correct subnet rule alone may not grant content rights, which 'Disable all storage firewall rules as a permanent workaround' does not establish. Do not count 'Disable all storage firewall rules as a permanent workaround' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Enter the workstation's private RFC1918 address in the public storage IP allowlist' fails the stated scenario where an approved VM subnet receives storage 403 responses after a network change because the storage endpoint sees the effective outbound source address, not an arbitrary private on-premises IP. The required multi-part resolution instead needs path allowlisting and data authorization are separate prerequisites; a correct subnet rule alone may not grant content rights, which 'Enter the workstation's private RFC1918 address in the public storage IP allowlist' does not establish. Do not count 'Enter the workstation's private RFC1918 address in the public storage IP allowlist' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Treat every storage 403 as proof the account is deleted' fails the stated scenario where an approved VM subnet receives storage 403 responses after a network change because a 403 can reflect failed network authorization or data permissions while the resource still exists. The required multi-part resolution instead needs path allowlisting and data authorization are separate prerequisites; a correct subnet rule alone may not grant content rights, which 'Treat every storage 403 as proof the account is deleted' does not establish. Do not count 'Treat every storage 403 as proof the account is deleted' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

SAS is a bearer authorization mechanism: a recipient can use an otherwise valid token within its permissions even without a normal Azure RBAC assignment. That observation explains how an issued SAS is consumed, not which kind of SAS the Entra-authenticated issuer should create. The question needs a delegated token that does not require possession of the storage account key. A user delegation SAS is signed using a user delegation key obtained with eligible Entra rights, and its scope and lifetime must still be restricted.

Disabling Shared Key authorization can be part of a separate migration plan, but it is not the SAS type the question asks the team to issue to its external recipient. Before turning it off, inventory existing account-key requests and key-signed SAS integrations because they can stop working; support differs by storage service. Here the issuer already authenticates using Microsoft Entra and wants to avoid sharing the account key. A scoped user delegation SAS addresses that token requirement directly without imposing an unrelated global authentication change.

An account SAS can cover operations across storage services, but it is signed using a storage account key and may grant broader permissions than a single blob integration requires. The stated issuer already uses Entra and explicitly wishes to avoid exposing that key to third parties. Issuing an account SAS is therefore the wrong mechanism when the supported blob operation can be delegated using an Entra-derived user delegation key. Account SAS remains appropriate in some multi-service scenarios; its existence does not justify abandoning the narrower credential boundary here.

Investigating a SAS token's type, signing authority and stored-access-policy association is essential when an existing token is leaked or must be revoked. That is a post-issuance incident-response question, not a selection of a token type for this newly planned Entra-authenticated integration. A stored policy can apply to certain service SAS tokens but not user delegation SAS. For the question at hand, issue the supported short-lived user delegation SAS only after verifying the signing principal's delegation-key authority and least-privilege data access.

A stored access policy can govern permissions, start time and expiry of an associated service SAS on a supported container, file share, queue or table. This is a control for some delegated resource-level operations within one service; it does not expand the SAS token to storage-account service-level operations across multiple services. Account SAS is a distinct account-key-signed type and cannot be associated with stored access policies. In the scenario, choosing a policy mechanism alone fails to provide the requested cross-service operation scope, regardless of how carefully the policy is configured.

SAS possession is sufficient to authorize a request only within the permissions, services, resources, signing-key validity and time limits encoded by that particular SAS. This bearer-token characteristic explains how a third-party process can operate without ordinary user Azure RBAC, but does not select an appropriate SAS type. A service SAS remains limited to its one storage service and cannot be broadened merely because anyone with the token can use it. The requirement for multiple services and service-level operations is the differentiator that points to an account SAS.

A service SAS linked to a stored access policy is useful for managed delegation within one storage service, such as access to blobs in a container. It permits a centrally adjustable expiry or permission scope for associated tokens. It does not authorize the wider account-wide Get/Set service-properties operations described here; nor does a stored policy turn it into a token for queue and blob service operations together. The client would still be limited by the service SAS service type even if its policy was otherwise valid and properly signed.

Choosing a revocation strategy depends on whether a SAS is ad hoc, a stored-policy-linked service SAS, or an account-key-signed account SAS. That distinction matters after the credential has been issued, especially because account and user-delegation SAS tokens cannot use stored access policies. But studying revocation by itself does not satisfy the requesting app's requirement to call service-level operations across multiple Azure Storage services. Select a supported SAS type and permissions first, then plan key security, revocation and short token validity appropriately.

The vendor needs one blob, not the ability to list the container or read a larger collection of blobs. A container SAS with Read and List expands the data reachable if the bearer token is exposed, and thirty days extends risk long after the review ends. A service SAS can be scoped to a blob, while user delegation SAS is preferred when the issuing workload can use Entra authorization. For this case, the administrator should bind permissions and expiry tightly to the one object and three-hour window.

Blob-level Read is the appropriate permission, but this proposed expiry is ten times longer than the authorized review interval. A SAS is a bearer credential: a client possessing the token can exercise its permissions while valid without receiving a separate role assignment. Long validity therefore matters even when the resource itself is narrow. The issuer should configure a three-hour interval, consider an appropriate start time and HTTPS-only use, and avoid assuming an email or contractual deadline automatically invalidates the token.

This SAS targets only the requested blob and has the correct time window, but Write and Delete exceed the vendor's duties. A token that can overwrite or remove a private artifact turns a read-only review into a modification capability. SAS permissions are evaluated independently of a recipient's ordinary Azure RBAC role, so a missing role assignment would not neutralize extra delegated actions. Restrict the token to Read; encrypt the request in transit and avoid distributing it beyond the authorized recipient.

An account SAS can be useful for multiple storage services or service-level operations that a resource-scoped SAS cannot perform. It is unnecessarily broad when one named blob is the only object the vendor should read. A bearer account SAS granting eligible reads can be reused against more resources than this approval covers. Do not infer that its three-hour expiry makes broad access acceptable. Select a blob-level SAS—preferably user delegation when supported by the issuer—with only the read permission and authorized validity interval.

'Use an account SAS when its broader service-operation scope is truly required' applies to a different feature boundary because service SAS targets one service resource; an account SAS can cover account-level service operations and multiple services. In the stated scenario where a SAS can enumerate blobs but an attempt to overwrite one fails, 'Use an account SAS when its broader service-operation scope is truly required' does not satisfy the mechanism that list access does not imply create, write, or delete rights; confirm token scope and expiry. The necessary action is 'Inspect whether the SAS includes the required write permission rather than only list', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Identify SAS type and signing/policy association before choosing a revocation method' is associated with this separate need: a leaked SAS needs revocation. It might be a service SAS using stored access policy, or an ad hoc user delegation SAS. That is because changing a stored access policy affects associated service SAS but not every ad hoc or user delegation token. Here a SAS can enumerate blobs but an attempt to overwrite one fails, so 'Identify SAS type and signing/policy association before choosing a revocation method' misses the fact that list access does not imply create, write, or delete rights; confirm token scope and expiry. 'Inspect whether the SAS includes the required write permission rather than only list' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Issue a resource-scoped read-only SAS with narrowly bounded validity' solves another task because SAS tokens are bearer credentials; minimize permissions and lifetime to the requested download. For the situation where a SAS can enumerate blobs but an attempt to overwrite one fails, this distractor misses the requirement that list access does not imply create, write, or delete rights; confirm token scope and expiry. Unlike 'Issue a resource-scoped read-only SAS with narrowly bounded validity', 'Inspect whether the SAS includes the required write permission rather than only list' directly targets that requirement; its success must be confirmed at the authorized resource scope.

An account SAS can authorize suitable service-level operations across Azure Storage services, but changing SAS type does not correct the timing validity of a token that fails immediately after issue. The failure describes not-before verification when clocks disagree, which affects independently of whether a SAS is an account SAS or a compatible service or user delegation SAS. Inspect the actual signed start and expiry times, ensure a short required lifetime, and allow for expected clock skew. Changing to a more powerful account SAS would unnecessarily widen access rather than fix the time validation boundary.

A valid SAS is a bearer token and can authorize its holder without an ordinary Azure role assignment, but this fact does not make a not-yet-valid signature usable. A Storage request checks signed validity dates as well as resource scope and permitted operations. The question supplies a newly issued token and a clock mismatch, so its likely failure is an overly strict start time relative to the service's clock. Use a safely earlier start or omit the start where supported, retain an appropriate expiry, and verify the same recipient can perform only the intended operation.

Identifying SAS type and stored-policy association is important when revoking a leaked token, because service SAS policy updates differ from ad hoc and user delegation token revocation. It does not directly resolve the reported new-token authentication failure caused by mismatched clocks. The specific fields to inspect are the SAS validity timestamps, particularly a future start, and the recipient's actual UTC clock or service-observed time. Correct the time window conservatively and retest, then evaluate token permissions and signature type only if the timing error no longer explains the failure.

The revocation mechanism differs among service SAS, account SAS and user delegation SAS. A stored access policy can affect associated service SAS tokens, while delegation signatures are governed by separate Entra-derived keys. Rotating an unrelated account key can disrupt healthy clients yet leave a user delegation SAS unaffected. The safe first step is to identify the leaked token type and how it was signed or associated with a policy before selecting the least-disruptive revocation action.

When all service SAS links referencing one stored access policy fail after that policy is deleted, the action 'Restore or replace the intentionally removed stored access policy where appropriate' can be relevant: linked SAS tokens depend on the referenced policy definition; removing the policy breaks their authorization. For the different problem of a leaked SAS needs revocation. It might be a service SAS using stored access policy, or an ad hoc user delegation SAS, 'Restore or replace the intentionally removed stored access policy where appropriate' misses the mechanism that changing a stored access policy affects associated service SAS but not every ad hoc or user delegation token. Choosing 'Restore or replace the intentionally removed stored access policy where appropriate' would address that other need, whereas 'Identify SAS type and signing/policy association before choosing a revocation method' is intended to solve the stated condition.

The nearby action 'Associate compatible service SAS tokens with a stored access policy on the container' is associated with this separate need: a container issues multiple service SAS links needing coordinated expiration changes. That is because a stored policy can change inherited expiry and permissions for linked service SAS tokens. Here a leaked SAS needs revocation. It might be a service SAS using stored access policy, or an ad hoc user delegation SAS, so 'Associate compatible service SAS tokens with a stored access policy on the container' misses the fact that changing a stored access policy affects associated service SAS but not every ad hoc or user delegation token. 'Identify SAS type and signing/policy association before choosing a revocation method' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use stored access policies only with supported service SAS, not user delegation or account SAS' solves another task because user delegation and account SAS are ad hoc and cannot inherit a stored access policy. For the situation where a leaked SAS needs revocation. It might be a service SAS using stored access policy, or an ad hoc user delegation SAS, this distractor misses the requirement that changing a stored access policy affects associated service SAS but not every ad hoc or user delegation token. Unlike 'Use stored access policies only with supported service SAS, not user delegation or account SAS', 'Identify SAS type and signing/policy association before choosing a revocation method' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Identify SAS type and signing/policy association before choosing a revocation method' applies to a different feature boundary because changing a stored access policy affects associated service SAS but not every ad hoc or user delegation token. In the stated scenario where an external recipient holds a valid SAS but has no ordinary Entra RBAC assignment on the storage account, 'Identify SAS type and signing/policy association before choosing a revocation method' does not satisfy the mechanism that possession of a valid SAS can authorize scoped data access without granting general Azure management rights. The necessary action is 'Recognize SAS bearer authorization independent of the recipient's normal role assignment', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use an account SAS when its broader service-operation scope is truly required' is associated with this separate need: an app needs an access token for service-level operations across multiple storage services, not just one blob container. That is because service SAS targets one service resource; an account SAS can cover account-level service operations and multiple services. Here an external recipient holds a valid SAS but has no ordinary Entra RBAC assignment on the storage account, so 'Use an account SAS when its broader service-operation scope is truly required' misses the fact that possession of a valid SAS can authorize scoped data access without granting general Azure management rights. 'Recognize SAS bearer authorization independent of the recipient's normal role assignment' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Issue a resource-scoped read-only SAS with narrowly bounded validity' solves another task because SAS tokens are bearer credentials; minimize permissions and lifetime to the requested download. For the situation where an external recipient holds a valid SAS but has no ordinary Entra RBAC assignment on the storage account, this distractor misses the requirement that possession of a valid SAS can authorize scoped data access without granting general Azure management rights. Unlike 'Issue a resource-scoped read-only SAS with narrowly bounded validity', 'Recognize SAS bearer authorization independent of the recipient's normal role assignment' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Identifying each token's SAS type and whether it uses a stored-policy identifier is essential before changing it, because a container policy can govern only qualifying service SAS tokens. But this inspection is not the configuration that centralizes expiration for the several links in the scenario. If the links are already ad hoc, merely classifying them leaves their independent expirations unchanged. Create a supported stored access policy on the relevant blob container, issue or replace the service SAS links with the policy identifier, and then verify that the intended constraints apply to those links.

A narrowly timed, read-only SAS for one blob limits that one recipient's access, which is good practice when the use case is a single short download. The question instead concerns coordinating expiration changes across several service SAS links issued for the same container. Independent ad hoc SAS links carry their own signed constraints; editing one link does not centrally alter its siblings. A stored access policy supplies a common server-side source for appropriate service SAS constraints. A read-only grant could still be part of that policy where justified, but it is not the central-management feature being requested.

An account SAS can authorize service-level operations and more than one Azure Storage service, which is broader than this container's delegated blob access requires. More importantly, Microsoft documents that account SAS tokens do not support association with stored access policies. Switching to an account SAS would therefore remove, rather than create, the specific coordinated expiry control needed here. Use a service SAS bound to the container's stored access policy. Account SAS is appropriate only when account-wide operation capabilities are actually required and broader delegated permissions are acceptable.

A valid SAS functions as a bearer authorization: its holder may perform the operations allowed by the signed token without holding a separate Azure data-role assignment on the destination account. That explains why a recipient can use a link, but it does not explain how an operator can change the expiration of several already issued links together. The revocation and expiry mechanism depends on SAS type and policy association. For this use case, eligible service SAS links should refer to the container's stored access policy, rather than relying on general bearer-token behavior.