Question

A partner application needs temporary read-only access to a single blob in your storage account. The access must expire in 24 hours and must only be usable from the partner's fixed public IP address (203.0.113.45). You want to grant this access without sharing your storage account keys or creating any new identities. What should you generate?

Accepted Answer

A service SAS scoped to the blob with read permission only, an expiry time of 24 hours, and an allowed IP address range of 203.0.113.45

Answer

A user delegation SAS with delete and write permissions scoped to the container

Answer

A second storage account access key and share it with the partner over a secure channel

Answer

A shared access signature with full account-level permissions and no IP restriction