Key points

• Entra data roles provide identity-based authorization without distributing account keys.
• A SAS delegates bounded permissions and expiry while remaining a bearer token.
• Stored access policies can govern associated service SAS tokens but not every SAS type.

Best-known use cases

• Delegate temporary access to one container.
• Authorize a managed workload with an Azure data role.

What candidates often confuse it with

• Account key vs SAS vs Entra: broad shared secret vs constrained delegation vs identity authorization.
• User delegation SAS vs service/account SAS: Entra-backed Blob delegation vs account-key-signed delegation.

Key takeaway

Prefer Entra authorization and use a narrowly scoped, short-lived SAS only when delegated bearer access is required.

Related services

• Azure Storage network security
• Azure Files

Relevant exam tasks

• D2.1.S1 — Configure Azure Storage firewalls and virtual networks
• D2.1.S2 — Create and use shared access signature (SAS) tokens
• D2.1.S3 — Configure stored access policies
• D2.1.S4 — Manage access keys
• D2.1.S5 — Configure identity-based access for Azure Files

Learn more

• Azure Storage authorization and shared access signatures documentation