Question

Your company issued several service SAS tokens to external partners for accessing a blob container named 'invoices'. A partner relationship has ended, and you must immediately revoke that partner's SAS token without affecting the other tokens or regenerating the storage account access keys. What should you have configured when creating the SAS tokens to enable this?

Accepted Answer

Associate each SAS token with a distinct stored access policy on the container

Answer

Set a short expiry time on every SAS token

Answer

Restrict each SAS token to a single allowed IP address

Answer

Use a user delegation SAS signed with a Microsoft Entra identity