Pass Your Microsoft AZ-104 Exam Easy!

Identifying each token's SAS type and whether it uses a stored-policy identifier is essential before changing it, because a container policy can govern only qualifying service SAS tokens. But this inspection is not the configuration that centralizes expiration for the several links in the scenario. If the links are already ad hoc, merely classifying them leaves their independent expirations unchanged. Create a supported stored access policy on the relevant blob container, issue or replace the service SAS links with the policy identifier, and then verify that the intended constraints apply to those links.

A narrowly timed, read-only SAS for one blob limits that one recipient's access, which is good practice when the use case is a single short download. The question instead concerns coordinating expiration changes across several service SAS links issued for the same container. Independent ad hoc SAS links carry their own signed constraints; editing one link does not centrally alter its siblings. A stored access policy supplies a common server-side source for appropriate service SAS constraints. A read-only grant could still be part of that policy where justified, but it is not the central-management feature being requested.

An account SAS can authorize service-level operations and more than one Azure Storage service, which is broader than this container's delegated blob access requires. More importantly, Microsoft documents that account SAS tokens do not support association with stored access policies. Switching to an account SAS would therefore remove, rather than create, the specific coordinated expiry control needed here. Use a service SAS bound to the container's stored access policy. Account SAS is appropriate only when account-wide operation capabilities are actually required and broader delegated permissions are acceptable.

A valid SAS functions as a bearer authorization: its holder may perform the operations allowed by the signed token without holding a separate Azure data-role assignment on the destination account. That explains why a recipient can use a link, but it does not explain how an operator can change the expiration of several already issued links together. The revocation and expiry mechanism depends on SAS type and policy association. For this use case, eligible service SAS links should refer to the container's stored access policy, rather than relying on general bearer-token behavior.

'Use stored access policies only with supported service SAS, not user delegation or account SAS' solves another task because user delegation and account SAS are ad hoc and cannot inherit a stored access policy. For the situation where all service SAS links referencing one stored access policy fail after that policy is deleted, this distractor misses the requirement that linked SAS tokens depend on the referenced policy definition; removing the policy breaks their authorization. Unlike 'Use stored access policies only with supported service SAS, not user delegation or account SAS', 'Policy changes govern associated service SAS tokens, not unrelated ad hoc SAS credentials' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Re-creating a deleted policy is a proposed administrative recovery action, not an explanation of why the original service SAS tokens failed. It may also undo a deliberate credential revocation or violate the tenant change process. First establish whether the stored access policy was removed as a security response and identify exactly which service SAS tokens referenced it. The causal explanation is that those SAS tokens depended on the policy and were invalidated when it disappeared. Any restoration should be separately approved and tested rather than assumed safe or automatic.

'Identify SAS type and signing/policy association before choosing a revocation method' applies to a different feature boundary because changing a stored access policy affects associated service SAS but not every ad hoc or user delegation token. In the stated scenario where all service SAS links referencing one stored access policy fail after that policy is deleted, 'Identify SAS type and signing/policy association before choosing a revocation method' does not satisfy the mechanism that linked SAS tokens depend on the referenced policy definition; removing the policy breaks their authorization. The necessary action is 'Policy changes govern associated service SAS tokens, not unrelated ad hoc SAS credentials', which should be checked against this Azure resource's actual permissions and state.

Azure Storage stored access policies are not supported for user delegation SAS tokens. Reissuing the token with the same unsupported policy association therefore cannot make the operation valid. User delegation SAS uses Microsoft Entra-derived delegation key material and its own explicit permissions and validity window. Stored access policies apply to supported service SAS cases. The right diagnosis is the unsupported SAS-policy combination, not an instruction to repeat it.

When an operator shortens one stored policy's expiry and assumes an unrelated ad hoc SAS is also revoked, the action 'Policy changes govern associated service SAS tokens, not unrelated ad hoc SAS credentials' can be relevant: ad hoc SAS bounds are signed into the token and require a different revocation or expiry approach. For the different problem of a team attempts to associate a user delegation SAS with a stored access policy and gets an unsupported configuration, 'Policy changes govern associated service SAS tokens, not unrelated ad hoc SAS credentials' misses the mechanism that user delegation and account SAS are ad hoc and cannot inherit a stored access policy. Choosing 'Policy changes govern associated service SAS tokens, not unrelated ad hoc SAS credentials' would address that other need, whereas 'Use stored access policies only with supported service SAS, not user delegation or account SAS' is intended to solve the stated condition.

'Restore or replace the intentionally removed stored access policy where appropriate' applies to a different feature boundary because linked SAS tokens depend on the referenced policy definition; removing the policy breaks their authorization. In the stated scenario where a team attempts to associate a user delegation SAS with a stored access policy and gets an unsupported configuration, 'Restore or replace the intentionally removed stored access policy where appropriate' does not satisfy the mechanism that user delegation and account SAS are ad hoc and cannot inherit a stored access policy. The necessary action is 'Use stored access policies only with supported service SAS, not user delegation or account SAS', which should be checked against this Azure resource's actual permissions and state.

Azure Storage does not maintain one global expiry for all SAS tokens on an account. Updating a stored access policy changes the constraints that are applied to compatible service SAS tokens referring to that policy identifier. Other SAS types or ad hoc signatures do not automatically gain a dependency on the edited policy. The example separates a service SAS policy from a user delegation SAS that was generated through Microsoft Entra credentials. A blanket revocation claim ignores their different signing and authorization paths; the latter remains governed by its own delegation key, signed validity, and access permissions.

A stored access policy may be referenced by a supported service SAS, but an account SAS or user delegation SAS must be issued as an ad hoc signature. Consequently, an unrelated user delegation SAS does not reference the container's `monthly` policy, and changing that policy's expiry cannot silently rewrite the user delegation SAS's signed expiry. The correct administrative action depends on the token type: a policy edit for linked service SAS, or the relevant user delegation signing key and token expiry controls for Entra-signed SAS. Treating all SAS types as policy-linked would produce a misleading revocation assumption.

An Azure Resource Manager ReadOnly lock limits management-plane changes to Azure resources; it does not rewrite the cryptographic signature or embedded expiry of a user delegation SAS. The question supplies a still-valid independently signed data-plane token. Whether an actual Blob read succeeds also depends on storage networking and SAS permissions, but the listed resource-group lock is not the policy edit that controls this SAS's expiry. Resource locks and SAS revocation operate at different layers, so invoking the lock does not explain the effect of shortening the unrelated stored access policy.

The unsupported operation is the proposed association of a user delegation SAS with a stored access policy. Azure Storage only supports stored access-policy association for a service SAS; the user delegation SAS remains ad hoc. Reissuing it with the `monthly` identifier therefore does not make it compliant with or protected by that policy. If a service SAS needed a coordinated expiry update, linking it to an existing policy might be useful, but in this example the second SAS was intentionally generated using Entra signing. Its expiry and key must be controlled through the user-delegation mechanism rather than an unrelated container policy.

A single shared stored access policy makes its permissions and expiry common to every associated service SAS. To satisfy both partners, a combined policy would give Partner B Read even though the partner only needs Create, and it could extend the B token past tomorrow. Changing that shared policy to address one partner could also disrupt the other. The scenario explicitly requires separate authority and revocation windows; therefore use distinct policy identifiers, not a union of both grants. The container supports a limited number of such policies, so govern those slots deliberately.

A user delegation SAS is normally the stronger choice when Microsoft Entra credentials can authorize its creation, but the proposed policy association is not supported. A user delegation SAS is ad hoc: it cannot be bound to a stored access policy. The scenario explicitly has existing account-key-signed service SAS tokens and requires their delegated permissions and times to be adjusted independently through container-stored identifiers. Changing the SAS type would not make the unsupported association valid. To use stored access policies, the tokens must be service SAS tokens of the supported kind.

An account SAS can delegate service-level or multi-service operations, but it is not controlled by a blob container's stored access policy. Microsoft documents stored access policies for supported service SAS tokens, not account SAS or user delegation SAS tokens. Even if two account SAS tokens were separately minted with appropriate expiry, the proposed policy-driven independent updates would not operate. The administrator should keep the service SAS design for this requirement, create separate named policies, and keep Partner A's read scope and Partner B's create scope disjoint.

Identifying the SAS type and policy association is prudent during a credential incident, because a service SAS linked to a policy can be affected by policy edits whereas other SAS types follow different revocation routes. In this scenario, the application is already known to use service SAS tokens associated with stored policy A, so the open decision is how to change that policy's expiry. Rotating both account keys is disproportionately disruptive to other clients using Shared Key credentials. Edit policy A's specified expiry, allow for propagation, and verify that links referencing A receive the intended constraints.

A stored access policy changes the permissions and validity of associated service SAS links, but not unrelated ad hoc account SAS or user delegation SAS tokens. That statement correctly describes the boundary, yet it does not tell the administrator which concrete change is needed to extend policy A's expiration. The question already identifies compatible tokens referencing that stored policy, so the targeted action is to edit its expiry setting. Account key regeneration would also invalidate key-signed tokens and applications that use the rotated key and is unnecessary solely to change that stored policy's time terms.

Stored access policies can be bound to compatible service SAS tokens and are not supported by account SAS or user delegation SAS signatures. Although that fact is relevant to designing a credential strategy, the workload here already uses a linked service SAS policy. Its validity window is governed by the policy rather than by an unrelated token type conversion. Updating the stored policy is the narrowest change. Confirm the policy identifier stays the same, avoid conflicting per-token validity fields, allow for possible propagation delay and test a representative existing link after the edit.

'Disable Shared Key while unmodified key-based clients still depend on it' fails the stated scenario where applications use the first storage account access key and operations must rotate it with minimal downtime because abruptly changing authorization mode can break dependent workloads without migration planning. The required multi-part resolution instead needs two keys support staged rollover, but all dependent clients must be inventoried and updated, which 'Disable Shared Key while unmodified key-based clients still depend on it' does not establish. Do not count 'Disable Shared Key while unmodified key-based clients still depend on it' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Regenerate the active key before migrating the applications' fails the stated scenario where applications use the first storage account access key and operations must rotate it with minimal downtime because regenerating a still-used key invalidates dependent client signatures and risks an outage. The required multi-part resolution instead needs two keys support staged rollover, but all dependent clients must be inventoried and updated, which 'Regenerate the active key before migrating the applications' does not establish. Do not count 'Regenerate the active key before migrating the applications' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Distribute both storage account keys permanently to every application' fails the stated scenario where applications use the first storage account access key and operations must rotate it with minimal downtime because sharing every account secret increases exposure and does not provide a controlled rollover sequence. The required multi-part resolution instead needs two keys support staged rollover, but all dependent clients must be inventoried and updated, which 'Distribute both storage account keys permanently to every application' does not establish. Do not count 'Distribute both storage account keys permanently to every application' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Change storage tags and assume credential signatures are renewed' fails the stated scenario where applications use the first storage account access key and operations must rotate it with minimal downtime because tags are metadata and do not regenerate or rebind account key-based authorization. The required multi-part resolution instead needs two keys support staged rollover, but all dependent clients must be inventoried and updated, which 'Change storage tags and assume credential signatures are renewed' does not establish. Do not count 'Change storage tags and assume credential signatures are renewed' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

A client can authenticate with one valid account key or an appropriate identity-based mechanism, but this describes a client authorization path rather than the reason two account keys exist. Shared Key is highly privileged and should not be distributed to unrelated contractors as a convenient access-management method. The two keys are operationally independent so one can remain usable when the other is regenerated; they do not grant different read/write rights. An Entra role or scoped SAS should provide less access when supported. Merely choosing one authentication method does not explain dual-key availability and safe renewal.

Disabling Shared Key authentication may be a useful later security-hardening step once every dependent client and integration can use an approved alternative. It does not explain the existence of key1 and key2. Also, changing this account-wide policy can disrupt clients and account/service SAS tokens tied to Shared Key, so it should not be presented as a trivial replacement for key management. The question asks about the operational purpose of multiple keys, which is continuity during controlled credential renewal. Account-wide authentication-policy migration must be designed and tested separately from understanding the two keys.

Regenerating both keys before moving clients can invalidate their active credentials together and interrupt live access, even though two keys exist. Account and service SAS tokens signed by either regenerated key can also stop working. The safe purpose of dual-key support is to allow one secret to remain active while the other is replaced and callers are updated under change control. The two names do not give a client automatic failover when its configured secret becomes invalid. This simultaneous-regeneration proposal defeats the continuity benefit and does not reduce the hazard of distributing full-access secrets to contractors.

'Migrate incompatible clients to supported Entra authorization before enforcing Shared-Key denial' applies to a different feature boundary because key-signed SAS or account-key requests may be affected; check exact service support and access method. In the stated scenario where a backup client stopped authenticating after the storage owner regenerated key1, 'Migrate incompatible clients to supported Entra authorization before enforcing Shared-Key denial' does not satisfy the mechanism that regenerated keys invalidate the old signature; DNS or resource group permissions are unrelated. The necessary action is 'Update the client to use a currently valid account key or approved Entra method', which should be checked against this Azure resource's actual permissions and state.

Regenerating a signing key invalidates clients still using its previous value. Repeating rotation on both keys before repairing an already broken client can increase disruption and does not cause the client to learn the new secret. The immediate diagnosis is a stale account key in the backup application; update it through an approved method or migrate to a supported Entra authorization path, then conduct future rotation with controlled overlap.

When a storage account exposes key1 and key2, and security claims this means both should be shared with all partners, the action 'Use dual keys for controlled credential rollover instead of unrestricted sharing' can be relevant: independent keys enable renewal without an immediate outage when clients are migrated carefully. For the different problem of a backup client stopped authenticating after the storage owner regenerated key1, 'Use dual keys for controlled credential rollover instead of unrestricted sharing' misses the mechanism that regenerated keys invalidate the old signature; DNS or resource group permissions are unrelated. Choosing 'Use dual keys for controlled credential rollover instead of unrestricted sharing' would address that other need, whereas 'Update the client to use a currently valid account key or approved Entra method' is intended to solve the stated condition.

Key rotation might be required for an account-key security incident, but the job has an explicit Entra authentication requirement and a prohibition on account keys. A new Shared Key credential would violate that constraint and would not teach why management Contributor is insufficient for private blob reads. Keep the existing identity and grant only the required Storage Blob DataActions at an appropriate account or container scope.

Azure Reader and storage-account management Contributor permit relevant resource-management operations, but they do not automatically include private blob data-plane read permissions. The failure occurs after network admission and with successful Entra sign-in. Another ARM Reader assignment therefore does not supply the required Blob DataActions. A narrow data-plane role for the service principal is necessary instead of broader management visibility.

A user delegation SAS can be a legitimate method for delegating Blob Storage access in other environments, but the stated security policy explicitly forbids all SAS tokens. Issuing one would create a bearer credential outside the mandated direct Entra RBAC authorization path. The proper repair is a scoped Storage Blob Data Reader assignment on the service principal, rather than making an otherwise technically supported SAS an unkeyed alternative.

Storage network admission and blob data permission are independent checks. The question states that the service principal reaches the service successfully and receives a data-read authorization denial. Adding an IP exception cannot supply missing data-plane Blob DataActions. It may create new public network exposure without fixing identity permissions. Keep network restrictions intact and grant a scoped read role to the established service principal.

A permanent account-wide Blob Data Reader assignment both overgrants other report data and presupposes that every recipient can authenticate as a suitable Microsoft Entra principal. The request is for temporary download access without handing out a persistent account key. Where supported, a short-lived user delegation SAS can expose only the intended blob and read permission, with an explicit expiry and a trusted issuer. A broad ongoing RBAC grant does not meet the intended temporary sharing or least-privilege boundary, even though narrowly scoped OAuth access may suit other integration designs.

When a leaked SAS needs revocation. It might be a service SAS using stored access policy, or an ad hoc user delegation SAS, the action 'Identify SAS type and signing/policy association before choosing a revocation method' can be relevant: changing a stored access policy affects associated service SAS but not every ad hoc or user delegation token. For the different problem of a report-download service needs temporary access without distributing a long-lived account key, 'Identify SAS type and signing/policy association before choosing a revocation method' misses the mechanism that entra-secured delegation limits token permissions and avoids handing out the storage account secret. Choosing 'Identify SAS type and signing/policy association before choosing a revocation method' would address that other need, whereas 'Issue a short-lived, least-privilege user delegation SAS when supported' is intended to solve the stated condition.

The nearby action 'Migrate incompatible clients to supported Entra authorization before enforcing Shared-Key denial' is associated with this separate need: a storage owner disables Shared Key and some legacy clients using account-key signatures fail. That is because key-signed SAS or account-key requests may be affected; check exact service support and access method. Here a report-download service needs temporary access without distributing a long-lived account key, so 'Migrate incompatible clients to supported Entra authorization before enforcing Shared-Key denial' misses the fact that entra-secured delegation limits token permissions and avoids handing out the storage account secret. 'Issue a short-lived, least-privilege user delegation SAS when supported' is the more defensible action; confirm its behavior in the target service before calling the task complete.