What's changed: Deepened AZ-104 Chapter 2 to Associate depth (tables, scenarios, FAQ, traps; localized figures)
2.3Storage Access and Azure Files
Understand ways to access storage (access keys, SAS, Entra ID + RBAC) and SMB/NFS file shares via Azure Files.
Stored data must be accessed securely. Azure Storage offers three main access methods: access keys, SAS, and Entra ID + RBAC.
2.3.1Access methods
- Access keys: full access to the whole account; high blast radius, so guard them and rotate regularly.
- SAS (shared access signature): delegated access scoped (what/which) and time-limited; ideal for temporary sharing with third parties.
- Entra ID + RBAC: identity-based, no keys; the most recommended approach.
2.3.2Azure Files
- Azure Files: managed file shares mountable over SMB/NFS; usable simultaneously by multiple VMs and on-prem.
- Great for lift-and-shift, replacing on-prem file servers with cloud shares.
Common on AZ-104: time-limited scoped temporary access = SAS, key-free recommended method = Entra ID + RBAC, and SMB share = Azure Files. Treat account keys as a last resort.
Storage access principle: "prefer identity-based, scope and time-limit delegation, keys as last resort." Access keys grant full account access with a large blast radius and require regular rotation (two keys for zero-downtime). A SAS (shared access signature) delegates scoped/time-limited access: the safer user delegation SAS (signed with Entra ID credentials), the account-wide account SAS, and the resource-scoped service SAS (binding it to a stored access policy—a separate server-side policy—lets you change expiry/permissions or revoke in bulk). Most recommended is Entra ID + RBAC (data-plane roles like Storage Blob Data Contributor, no keys). For boundary control, disable public access, restrict to specific VNets via firewall/service endpoints/private endpoints, and enforce HTTPS in transit. Azure Files provides SMB/NFS managed shares with Entra Kerberos/AD DS auth and Azure File Sync for on-prem sync. The axes: "temporary delegation = SAS," "permanent/keyless = Entra ID + RBAC," "SMB share = Azure Files," "VNet-only = private endpoint."
| Requirement | Use |
|---|---|
| Permanent, key-free access | Entra ID + RBAC |
| Time/scope-limited delegation | SAS (prefer user delegation SAS) |
| Allow only from a VNet | Private endpoint / firewall |
| SMB/NFS shared files | Azure Files (+ File Sync) |
Scenario: give an external vendor 30-minute read access to one container, internal apps permanent access, and forbid public exposure. External: a user delegation SAS (read, 30 min, that container only). Internal apps: Entra ID + RBAC (Storage Blob Data Reader, keyless). Prevent exposure with disabled public access + a private endpoint (VNet-only) and enforced HTTPS. Avoid account keys; rotate if used.
Q. Temporary scoped hand-off? SAS (user delegation SAS is safest). Q. Permanent/keyless? Entra ID + RBAC. Q. SMB share? Azure Files. Q. Allow only from a VNet? Private endpoint/firewall. Q. Revoke SAS in bulk? Stored access policy. Q. On-prem sync? Azure File Sync.
Watch the mix-ups: (1) Account keys grant full access (large blast radius)—don’t distribute them; use Entra ID/SAS. (2) A SAS is hard to revoke individually once issued (invalidate via a stored access policy or key regeneration). (3) RBAC data-plane roles (Storage Blob Data *) differ from management-plane (Contributor)—data read/write needs the former. (4) Azure Files SMB needs port 445 (often blocked by on-prem firewalls).
A SAS lets you specify the target (container/blob), allowed operations (read/write, etc.), and expiry—enabling minimal sharing while limiting exposure.
2.3.3Section summary
- Prefer Entra ID + RBAC; use SAS for temporary sharing; guard keys
- Azure Files = SMB/NFS shared files (used by multiple VMs/on-prem)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to give a third party time-limited, scoped access to a specific blob. What fits best?
Q2. Which managed file share can be mounted over SMB by multiple VMs at once?
Q3. Which is the most recommended (key-free) way to access storage?