Your company has an Azure Storage account named storecorp2026 that contains a private blob container named insights. You need to grant an external partner temporary access to read and list blobs within the insights container. The partner must meet the following security requirements:
- Access must be limited to the IP address range 203.0.113.0/24.
- The access must expire automatically after 48 hours.
- Access must be secured using Microsoft Entra ID credentials to avoid exposing the storage account access keys.
- The partner must only connect using HTTPS.
Which two actions should you perform to configure the required access? (Select two.)
- Assign the Storage Blob Data Delegator role to the Azure administrator who will generate the SAS.Cevap
- Generate a User Delegation SAS token with the Allowed IP parameter set to 203.0.113.0/24 and the Allowed Protocols parameter set to HTTPS only.Cevap
- CGenerate a Service SAS token signed by the storage account access key and set the validity duration to 7 days.
- DAssign the Reader role at the storage account level to the partner's account and disable the 'Allow trusted Microsoft services to access this storage account' option.
Cevap
The correct actions are to assign the Storage Blob Data Delegator role to the administrator generating the SAS, and to generate a User Delegation SAS token specifying the required IP range and HTTPS only.
To meet the requirement of avoiding storage account access keys, a User Delegation SAS must be used. Generating this token requires the administrator to possess the Storage Blob Data Delegator role to obtain the user delegation key. The SAS token itself must contain the parameters limiting access to the specific IP address range and requiring HTTPS.
Adım Adım Çözüm
Anahtar Kavram
Generating and securing access to storage using User Delegation SAS with Microsoft Entra ID credentials.