Domain 2 of 5 · Chapter 1 of 3

Storage Access

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Azure Administrator premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Two gates: the network layer and the authorization layer
  • The authorization layer: keys, SAS, and stored access policies
  • Identity-based access for Azure Files (SMB)
  • Exam-pattern recognition

Choosing a data-access mechanism for Azure Storage

DimensionAccess key (Shared Key)SAS tokenMicrosoft Entra ID (RBAC)
CredentialAccount key1/key2 (512-bit)Signed token: Entra key (user delegation) or account key (service/account)Entra identity: user, group, or managed identity
Scope of accessFull access to all data in the accountSpecific resources, permissions, and time windowPer-resource Azure role assignment (least privilege)
Granularity / least privilegeNone: all or nothingFine-grained (per resource, permission, expiry, IP)Fine-grained via built-in/custom data roles
RevocationRegenerate the key (breaks all tokens it signed)Delete the stored access policy (service SAS) or rotate the signing key/credentialRemove the role assignment
Identity auditedNo: one shared secret, no per-user trailNo: SAS generation isn't auditedYes: actions tie to an Entra principal
Microsoft recommendationAvoid; disable Shared Key where possibleUse a user delegation SAS when a token is neededPreferred default for blob, queue, and table data

Decision tree

SMB Azure Files share?(keep Windows identities)YesIdentity-based authenticationAD DS / Entra Kerberos (SMB)NoCaller has an Entra identity?(user, group, managed identity)YesMicrosoft Entra ID (RBAC)preferred default; least privilegeNo (external)Need on-demand revocationwithout rotating keys?NoUser delegation SASEntra-signed; no account key exposedYesService SAS +stored access policyLast resort: access keys (key1/key2) — full access, no scopingrotate regularly; disallow Shared Key where possible
Cheat sheet

Cheat sheet

  • Network rules and authorization are two independent gates: both must pass
  • A new storage account allows all networks until you restrict it
  • A virtual network rule requires the Microsoft.Storage service endpoint on the subnet
  • Use IP rules for on-premises callers, virtual network rules for Azure subnets
  • A storage account allows up to 400 virtual network rules and 400 IP rules
  • Allow first-party Azure services through the firewall with the trusted-services exception
  • The three SAS types are distinguished by what signs them
  • Prefer a user delegation SAS: it never exposes the account key
  • An account SAS spans services; a service SAS reaches one
  • Always send a SAS over HTTPS with least privilege and short lifetime
  • Bind a service SAS to a stored access policy to revoke it without rotating keys
  • Stored access policies: five per container, and service-SAS only
  • Each account has two access keys that grant full, unscoped access
  • Rotate access keys one at a time so applications never lose access
  • Disallow Shared Key authorization to enforce Entra Conditional Access
  • Azure Files identity-based authentication works over SMB only
  • Enable exactly one Azure Files identity source per storage account
  • Azure Files SMB authorizes in two layers: share-level RBAC then file-level NTFS ACLs
  • Choose Microsoft Entra Kerberos for cloud-only identities or macOS clients
  • Management roles like Owner and Contributor grant no access to blob or file data
  • A private endpoint created without RBAC on the target shows Pending until the owner approves it
  • A private endpoint needs a privatelink private DNS zone linked to every VNet that resolves it
  • Each storage service needs its own private endpoint
  • AzFilesHybrid's Join-AzStorageAccount domain-joins the account as an AD DS computer object
  • A user delegation SAS can never outlive its 7-day user delegation key
  • Azure Files AD DS auth needs hybrid identities and a domain-joined client for ACLs

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. Azure Storage firewall rules
  2. https://learn.microsoft.com/en-us/azure/storage/common/authorize-data-access
  3. Manage account access keys
  4. Grant limited access to data with shared access signatures (SAS)
  5. Overview - Azure Files identity-based authentication