Question

You manage an Azure SQL Database that must write vulnerability assessment scan results and audit logs to an Azure Storage account. Company policy forbids storing storage account keys or SAS tokens anywhere in the database configuration. You need to configure the database to authenticate to the storage account following least-privilege principles without embedding any secrets. What should you do?

Accepted Answer

Enable a system-assigned managed identity on the logical server, grant it the Storage Blob Data Contributor role on the storage account, and configure auditing to use managed identity authentication.

Answer

Create a DATABASE SCOPED CREDENTIAL that stores a shared access signature (SAS) token for the storage container and reference it in the audit configuration.

Answer

Generate a storage account access key, store it in an Azure Key Vault secret, and paste the key value into the audit destination settings.

Answer

Add the storage account to the server's firewall allow list and enable anonymous blob access on the target container.