Storage Access & Security
Keys, shared access signatures, Entra ID data roles, network rules and private connectivity for storage endpoints.
Readiness
0%
2h 10m baseline
Exam memorization points
- Every account has two access keys. Either key grants full control of the data plane and can be rotated independently.
- SAS flavours in ascending safety: account SAS (uses the account key), service SAS (account key or a stored access policy), user delegation SAS (Entra ID credentials, recommended, maximum 7 days).
- A stored access policy is the only way to revoke an individual service SAS without rotating the account key.
- Data-plane RBAC roles follow the pattern Storage Blob Data Reader, Contributor, Owner - and they are required when shared key access is disabled.
- Shared Key access can be disabled account-wide, which forces every caller to use Entra ID identities or SAS.
- Network controls are layered: public network access (all or selected networks), firewall IP ranges, VNet service endpoints, private endpoints, and Allow trusted Microsoft services.
Traps & distractors
- Trying to revoke an account SAS. Because it is signed with the account key, the only revocation is key rotation.
- Assuming Owner or Contributor on the account grants blob data access. Data-plane roles are separate and are the exam's expected answer.
- Creating a user delegation SAS when the caller lacks the generateUserDelegationKey permission - the operation fails.
- Setting public network access to selected networks and then adding a private endpoint without adjusting the firewall, which breaks clients.
- Forgetting that service endpoints grant a subnet access to the public endpoint and do not create a private IP; only private endpoints do that.
Suggested lab
Disable shared key access and use a user delegation SAS
Experience the failure modes around storage data-plane authorisation.
- 1Create a storage account and a container, then try to list blobs with only Owner on the subscription and confirm the failure.
- 2Assign yourself Storage Blob Data Contributor and list blobs successfully.
- 3Disable shared key access on the account and confirm the Azure portal still works through Entra ID.
- 4Create a stored access policy with read-only permission, then a service SAS bound to that policy and revoke it by editing the policy.
- 5Create a user delegation SAS with the Azure CLI and compare its maximum validity with an account SAS.
Microsoft Learn
- Authorize access to data in Azure Storagedoc
- Search Microsoft Learn: storage shared access signature user delegation stored access policysearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
High priority
Strong exam value. Schedule this week.
- Exam importance80% × 30% = 24.0
Learner-agnostic frequency on the real exam (4/5).
- Blueprint weight78% × 25% = 19.4
This topic's domain carries 17.5% of the exam objectives.
- Dependency leverage0% × 20% = 0.0
Nothing else in the graph depends on this topic.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Leaf topic - nothing depends on it.
Baseline study time
2h 10m
Complexity
4 / 5
Remaining to target
1h 51m
Status weight
0%
Topics: sas, access key, shared key, firewall, private endpoint, service endpoint, data plane
Weak neighbours in Storage