An administrator is configuring secure access to a blob container named compliance-records in an Azure Storage account named auditstoreprod. An external auditing application requires read-only access to the blobs. Security policy dictates that storage account access keys must not be used, and access must be authenticated using Microsoft Entra ID credentials. The connection must be restricted to the IP range 198.51.100.0/24 and must use HTTPS only. Which two configuration actions should you perform to meet these requirements?
- Generate a User Delegation SAS signed with a user delegation key acquired using Microsoft Entra ID credentials.Answer
- Configure the SAS token parameters to restrict access to the IP address range 198.51.100.0/24 and set the allowed protocol to HTTPS only.Answer
- CSet the SAS token expiration time to 10 days from the generation time to cover the duration of the audit.
- DAssign the Reader role at the storage account scope to the application's service principal to grant read access to the blob data.
Answer
Generate a User Delegation SAS signed with a user delegation key acquired using Microsoft Entra ID credentials, and configure the SAS token parameters to restrict access to the IP address range 198.51.100.0/24 and set the allowed protocol to HTTPS only.
To meet the security requirements, a User Delegation SAS must be generated because it is signed with Microsoft Entra ID credentials rather than the storage account keys. Furthermore, the IP address constraints and HTTPS protocol must be configured directly within the SAS token parameters to restrict access. A User Delegation SAS has a maximum lifetime of 7 days, and control plane roles like Reader do not grant data plane read access.
Step-by-Step Solution
Key Concept
Configuring a User Delegation SAS with security constraints such as allowed IP ranges and HTTPS-only protocols, and understanding its lifetime limitations.