An organization has a web application that provides temporary write access to an Azure Blob Storage container named `uploads` for external clients. You must meet the following requirements:
- Enable the security team to revoke access tokens immediately without impacting other clients or rotating the storage account keys.
- Limit the lifetime of individual client tokens to a maximum of 30 minutes.
- Enforce the use of secure connections only.
Which two actions should you perform to meet these requirements?
- Create a stored access policy on the container and specify the policy identifier when generating a service-level SAS token.Answer
- Set the allowed protocols on the stored access policy or the generated SAS token to HTTPS only.Answer
- CCreate a stored access policy at the storage account level and associate it with an account-level SAS token.
- DGenerate a SAS token signed with Microsoft Entra ID credentials and associate it with a stored access policy.
Answer
Create a stored access policy on the container and specify the policy identifier when generating a service-level SAS token, and set the allowed protocols on the stored access policy or the generated SAS token to HTTPS only.
The correct actions are to create a stored access policy on the container and reference it when generating a service-level SAS, and to enforce HTTPS only on the policy or token. A stored access policy allows for immediate revocation of the associated SAS tokens by modifying or deleting the policy. Restricting the protocol to HTTPS ensures all transit is encrypted.
Step-by-Step Solution
Key Concept
Implementing container-level stored access policies to manage and revoke Service Shared Access Signatures (SAS) with protocol constraints.