You have an Azure subscription that contains a You need to grant user1 access to blob1. The solution must ensure that the access expires after six…

A Shared Access Signature (SAS) is the most appropriate solution for providing temporary, delegated access to a specific resource in Azure Storage. A SAS is a URI that includes a token containing a set of query parameters. These parameters define the permissions granted (e.g., read, write), the resource being accessed (in this case, blob1), and a validity interval, including a mandatory expiry time. This allows you to grant user1 access to blob1 that automatically expires after the specified six-day period, meeting all the requirements of the scenario precisely.

A. a shared access policy: A shared access policy is defined on a container to manage a group of SAS tokens, but it does not directly grant access itself. A SAS is still required.

C. role-based access control (RBAC): RBAC grants permissions to identities (users, groups) but does not natively provide a simple, time-bound expiry mechanism. This would grant persistent access until manually revoked.

D. a managed identity: A managed identity is an identity for an Azure resource (like a VM or Function App) to authenticate to other services, not for granting access to an external user.

1. Microsoft Documentation

"Grant limited access to Azure Storage resources using shared access signatures (SAS)": "A shared access signature (SAS) provides secure delegated access to resources in your storage account. With a SAS

you have granular control over how a client can access your data. For example: ... How long the SAS is valid

including the start time and the expiry time." This document explicitly details the use of an expiry time as a core feature of SAS.

2. Microsoft Documentation

"Authorize access to data in Azure Storage": In the section "Authorize access with Azure AD"

it describes RBAC for storage. In the section "Authorize access with a shared access signature"

it states

"A SAS gives you granular control over how a client can access your data. You can specify which permissions the client has and for how long the SAS is valid." This highlights the specific use case for time-limited access.

3. Microsoft Documentation

"What are managed identities for Azure resources?": "Managed identities for Azure resources is a feature of Azure Active Directory... Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication." This confirms managed identities are for resources

not for granting access to users like user1.

4. Microsoft Documentation

"Define a stored access policy": "A stored access policy provides an additional level of control over service-level shared access signatures (SAS) on the server side... You can use a stored access policy to change the start time

expiry time

or permissions for a signature". This clarifies that the policy is a management layer for SAS

not the access mechanism itself.