Question

An Azure SQL Database needs to run a stored procedure that imports data from an Azure Blob Storage container using BULK INSERT. Company policy prohibits storing any storage account keys, SAS tokens, or secrets in the database or application configuration. You must configure the database to authenticate to the storage account securely. What should you configure?

Accepted Answer

Create a DATABASE SCOPED CREDENTIAL that references a system-assigned managed identity and grant that identity the Storage Blob Data Reader role on the storage account

Answer

Create a DATABASE SCOPED CREDENTIAL that stores a shared access signature (SAS) token generated for the container

Answer

Add the storage account key to an Azure Key Vault and reference it from the connection string

Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key on the storage account