account keys permit much broader shared-key authorization than a restricted SAS token. In this case, an application needs delegation to blobs using an Entra identity rather than signing with an account key. “Do not disclose account keys when the scoped SAS already provides required access” would not satisfy that requirement; the supported action is “A user delegation SAS for Blob Storage”. A user delegation SAS is authorized by Microsoft Entra credentials rather than the storage account shared key.

least-privilege SAS design restricts access to only the needed resource and actions. In this case, an application needs delegation to blobs using an Entra identity rather than signing with an account key. “Excessively broad SAS resource scope and permissions” would not satisfy that requirement; the supported action is “A user delegation SAS for Blob Storage”. A user delegation SAS is authorized by Microsoft Entra credentials rather than the storage account shared key.

a stored access policy can govern associated service SAS validity and revocation. In this case, an application needs delegation to blobs using an Entra identity rather than signing with an account key. “Associate the service SAS with a stored access policy and revoke or change that policy” would not satisfy that requirement; the supported action is “A user delegation SAS for Blob Storage”. A user delegation SAS is authorized by Microsoft Entra credentials rather than the storage account shared key.

a user delegation SAS is authorized by Microsoft Entra credentials rather than the storage account shared key. In this case, a vendor receives a SAS URL and asks for the account key too. “A user delegation SAS for Blob Storage” would not satisfy that requirement; the supported action is “Do not disclose account keys when the scoped SAS already provides required access”. Account keys permit much broader shared-key authorization than a restricted SAS token.

least-privilege SAS design restricts access to only the needed resource and actions. In this case, a vendor receives a SAS URL and asks for the account key too. “Excessively broad SAS resource scope and permissions” would not satisfy that requirement; the supported action is “Do not disclose account keys when the scoped SAS already provides required access”. Account keys permit much broader shared-key authorization than a restricted SAS token.

delegated token design should account for expiration and revocation before distribution. In this case, a vendor receives a SAS URL and asks for the account key too. “Use short SAS lifetimes and a revocation-capable design when supported” would not satisfy that requirement; the supported action is “Do not disclose account keys when the scoped SAS already provides required access”. Account keys permit much broader shared-key authorization than a restricted SAS token.

a user delegation SAS is authorized by Microsoft Entra credentials rather than the storage account shared key. In this case, a long-running external integration uses SAS tokens that cannot be individually revoked easily. “A user delegation SAS for Blob Storage” would not satisfy that requirement; the supported action is “Use short SAS lifetimes and a revocation-capable design when supported”. Delegated token design should account for expiration and revocation before distribution.

account keys permit much broader shared-key authorization than a restricted SAS token. In this case, a long-running external integration uses SAS tokens that cannot be individually revoked easily. “Do not disclose account keys when the scoped SAS already provides required access” would not satisfy that requirement; the supported action is “Use short SAS lifetimes and a revocation-capable design when supported”. Delegated token design should account for expiration and revocation before distribution.

short expiration reduces the lifetime of a leaked delegated access token. In this case, a long-running external integration uses SAS tokens that cannot be individually revoked easily. “Reduce the SAS expiration to the approved access period” would not satisfy that requirement; the supported action is “Use short SAS lifetimes and a revocation-capable design when supported”. Delegated token design should account for expiration and revocation before distribution.

applications holding the old key must be reconfigured as part of a safe rotation procedure. In this case, a storage administrator suspects an account key was exposed publicly. “Update the dependent client to the new valid shared key” would not satisfy that requirement; the supported action is “Rotate the affected storage account key and update legitimate clients”. Key rotation invalidates compromised shared-key credentials after dependent applications are migrated safely.

dual account keys can support continuity during shared-key credential rotation. In this case, a storage administrator suspects an account key was exposed publicly. “They enable staggered key rotation while clients move between credentials” would not satisfy that requirement; the supported action is “Rotate the affected storage account key and update legitimate clients”. Key rotation invalidates compromised shared-key credentials after dependent applications are migrated safely.

disallowing shared keys reduces risk from broad, long-lived credentials, after compatibility is assessed. In this case, a storage administrator suspects an account key was exposed publicly. “Disable shared-key authorization where supported and migrate to Entra-based access” would not satisfy that requirement; the supported action is “Rotate the affected storage account key and update legitimate clients”. Key rotation invalidates compromised shared-key credentials after dependent applications are migrated safely.

key rotation invalidates compromised shared-key credentials after dependent applications are migrated safely. In this case, a production service uses one storage key while rotating the other. “Rotate the affected storage account key and update legitimate clients” would not satisfy that requirement; the supported action is “They enable staggered key rotation while clients move between credentials”. Dual account keys can support continuity during shared-key credential rotation.

applications holding the old key must be reconfigured as part of a safe rotation procedure. In this case, a production service uses one storage key while rotating the other. “Update the dependent client to the new valid shared key” would not satisfy that requirement; the supported action is “They enable staggered key rotation while clients move between credentials”. Dual account keys can support continuity during shared-key credential rotation.

managed identity and granular data-plane roles avoid distributing powerful long-lived secrets. In this case, a production service uses one storage key while rotating the other. “Use supported identity-based authorization instead of storing shared account keys” would not satisfy that requirement; the supported action is “They enable staggered key rotation while clients move between credentials”. Dual account keys can support continuity during shared-key credential rotation.

disallowing shared keys reduces risk from broad, long-lived credentials, after compatibility is assessed. In this case, an application uses account keys embedded in deployment scripts. “Disable shared-key authorization where supported and migrate to Entra-based access” would not satisfy that requirement; the supported action is “Use supported identity-based authorization instead of storing shared account keys”. Managed identity and granular data-plane roles avoid distributing powerful long-lived secrets.

applications holding the old key must be reconfigured as part of a safe rotation procedure. In this case, an application uses account keys embedded in deployment scripts. “Update the dependent client to the new valid shared key” would not satisfy that requirement; the supported action is “Use supported identity-based authorization instead of storing shared account keys”. Managed identity and granular data-plane roles avoid distributing powerful long-lived secrets.

sMB access combines authentication with appropriate Azure share and file-level authorization. In this case, an application uses account keys embedded in deployment scripts. “Supported identity-based authentication for Azure Files plus share/file permissions” would not satisfy that requirement; the supported action is “Use supported identity-based authorization instead of storing shared account keys”. Managed identity and granular data-plane roles avoid distributing powerful long-lived secrets.

grant the minimum share data-plane role rather than broad account management rights. In this case, a team must give users file access over SMB using enterprise identities. “A suitably scoped Azure Files data-access role and file permissions” would not satisfy that requirement; the supported action is “Supported identity-based authentication for Azure Files plus share/file permissions”. SMB access combines authentication with appropriate Azure share and file-level authorization.

resource management read permission does not automatically confer permissions to shared files. In this case, a team must give users file access over SMB using enterprise identities. “Azure Files share-level and underlying data access permissions” would not satisfy that requirement; the supported action is “Supported identity-based authentication for Azure Files plus share/file permissions”. SMB access combines authentication with appropriate Azure share and file-level authorization.

The requested SMB access requires supported Azure Files identity integration and share/file authorization. In this case, a team must give users file access over SMB using enterprise identities. “Replace account keys with an unrelated managed identity without enabling Azure Files identity authentication or share permissions” would not satisfy that requirement; the supported action is “Supported identity-based authentication for Azure Files plus share/file permissions”. SMB access combines authentication with appropriate Azure share and file-level authorization.

Resource Reader does not grant SMB share data access or NTFS file permissions. In this case, a user has storage-account Reader but cannot open an Azure file share. “An Azure resource Reader role alone” would not satisfy that requirement; the supported action is “Azure Files share-level and underlying data access permissions”. Resource management read permission does not automatically confer permissions to shared files.

Blob objects use a different data plane from Azure Files SMB shares. In this case, a user has storage-account Reader but cannot open an Azure file share. “A Storage Blob Data Reader role” would not satisfy that requirement; the supported action is “Azure Files share-level and underlying data access permissions”. Resource management read permission does not automatically confer permissions to shared files.

A policy initiative cannot replace share-level and file permission authorization. In this case, a user has storage-account Reader but cannot open an Azure file share. “An Azure Policy initiative alone” would not satisfy that requirement; the supported action is “Azure Files share-level and underlying data access permissions”. Resource management read permission does not automatically confer permissions to shared files.

Management-plane read cannot replace file-share and NTFS authorization for SMB data. In this case, a file administrator must access one share but not change account configuration. “Reader role on the file share resource only” would not satisfy that requirement; the supported action is “A suitably scoped Azure Files data-access role and file permissions”. Grant the minimum share data-plane role rather than broad account management rights.

Blob RBAC operates on the Blob service, not Azure Files SMB access. In this case, a file administrator must access one share but not change account configuration. “Storage Blob Data Contributor on a blob container” would not satisfy that requirement; the supported action is “A suitably scoped Azure Files data-access role and file permissions”. Grant the minimum share data-plane role rather than broad account management rights.

Public DNS zone management does not authorize a user to open files. In this case, a file administrator must access one share but not change account configuration. “Creating a new Azure DNS public zone” would not satisfy that requirement; the supported action is “A suitably scoped Azure Files data-access role and file permissions”. Grant the minimum share data-plane role rather than broad account management rights.

key rotation invalidates compromised shared-key credentials after dependent applications are migrated safely. In this case, a service still uses an old account key after a planned rotation. “Rotate the affected storage account key and update legitimate clients” would not satisfy that requirement; the supported action is “Update the dependent client to the new valid shared key”. Applications holding the old key must be reconfigured as part of a safe rotation procedure.

dual account keys can support continuity during shared-key credential rotation. In this case, a service still uses an old account key after a planned rotation. “They enable staggered key rotation while clients move between credentials” would not satisfy that requirement; the supported action is “Update the dependent client to the new valid shared key”. Applications holding the old key must be reconfigured as part of a safe rotation procedure.

grant the minimum share data-plane role rather than broad account management rights. In this case, a service still uses an old account key after a planned rotation. “A suitably scoped Azure Files data-access role and file permissions” would not satisfy that requirement; the supported action is “Update the dependent client to the new valid shared key”. Applications holding the old key must be reconfigured as part of a safe rotation procedure.

managed identity and granular data-plane roles avoid distributing powerful long-lived secrets. In this case, an organization wants to prevent apps from using storage shared-key authorization. “Use supported identity-based authorization instead of storing shared account keys” would not satisfy that requirement; the supported action is “Disable shared-key authorization where supported and migrate to Entra-based access”. Disallowing shared keys reduces risk from broad, long-lived credentials, after compatibility is assessed.

key rotation invalidates compromised shared-key credentials after dependent applications are migrated safely. In this case, an organization wants to prevent apps from using storage shared-key authorization. “Rotate the affected storage account key and update legitimate clients” would not satisfy that requirement; the supported action is “Disable shared-key authorization where supported and migrate to Entra-based access”. Disallowing shared keys reduces risk from broad, long-lived credentials, after compatibility is assessed.

dual account keys can support continuity during shared-key credential rotation. In this case, an organization wants to prevent apps from using storage shared-key authorization. “They enable staggered key rotation while clients move between credentials” would not satisfy that requirement; the supported action is “Disable shared-key authorization where supported and migrate to Entra-based access”. Disallowing shared keys reduces risk from broad, long-lived credentials, after compatibility is assessed.