Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that…

Every service- and account-level SAS or stored-access-policy signature for a Storage account is produced by hashing the request with either the primary or the secondary account key. When you regenerate an account key, its value changes; any signature that was computed with the old value can no longer be validated by Azure Storage. Consequently, all requests to the Blob and File services that rely on those SAS tokens fail, effectively revoking every previously issued SAS. Because the scenario only mentions SAS-based access, regenerating both keys blocks all unauthorized access to sa1 and fulfils the goal.

B. Regenerating the keys is the documented immediate method for invalidating all existing SAS; therefore, the solution does meet the goal.

1. Microsoft Docs – “Secure access to data in Azure Storage: Revoking a SAS” (v2023-08-01)

§“Revoke a SAS by rotating the account key”. https://learn.microsoft.com/azure/storage/common/storage-sas-overview

2. Microsoft Docs – “Manage storage account access keys” (v2023-07-31)

§“Regenerate access keys”. https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage

3. Microsoft Docs – “Grant limited access to Azure Storage resources using shared access signatures”

§“Effect of key rotation on existing SAS”. https://learn.microsoft.com/azure/storage/common/storage-shared-access-signature

(Each reference states that rotating either account key immediately invalidates every SAS signed with that key.)