You have an Azure Machine Learning workspace named workspaces. You must add a datastore that connects an Azure Blob storage container to workspaces…

A Shared Access Signature (SAS) token is the most appropriate authentication method for this scenario. A SAS token provides secure, delegated access to resources in an Azure storage account. It allows for granular control by enabling you to specify permissions (such as read, write, list), a validity period (start and end time), and the specific resources (e.g., a specific container) that can be accessed. This directly addresses the requirement to "configure a privilege level" as the permissions are embedded within the token itself.

A. Account key: This provides full administrative access to the entire storage account and does not allow for configuring granular or restricted privilege levels.

C. Service principal: This is an identity. Its privileges are managed externally by assigning Azure RBAC roles (e.g., Storage Blob Data Reader), not configured within the credential itself.

D. Managed identity: Similar to a service principal, a managed identity is an identity whose access permissions are configured externally through Azure RBAC role assignments.

1. Microsoft Azure Documentation

"Create datastores": This document outlines the methods for creating datastores in Azure Machine Learning. It lists sastoken as a specific authentication parameter for registerazureblobcontainer

distinct from identity-based options. See the section "Authentication types".

2. Microsoft Azure Documentation

"Delegate access with a shared access signature": This source details how SAS tokens work. Under the section "How a SAS works

" it states

"With a SAS

you have granular control over how a client can access your data. For example: ... The permissions that are available to the client." This directly supports the concept of configuring a privilege level.

3. Microsoft Azure Documentation

"Connect to storage with identity-based data access": This document explains authentication using Azure Active Directory identities (service principals and managed identities). It clarifies that for these methods

you "grant your managed identity access to your storage account" by assigning an appropriate RBAC role

confirming that privilege configuration is external to the identity itself. See the section "Grant access to the storage service".