Developing Solutions for Microsoft Azure (AZ-204) Practice Exam

What feature does a user delegation SAS include for increased security?

1. Access control list

2. Azure Key Vault integration

3. Azure Active Directory credentials

4. Log analytics support

The correct answer is: Azure Active Directory credentials

A user delegation Shared Access Signature (SAS) is a secure way to grant limited access to Azure Storage resources without sharing the account keys. The inclusion of Azure Active Directory (AAD) credentials significantly enhances security in a user delegation SAS. This is because it relies on the robust authentication and authorization mechanisms provided by Azure Active Directory. By requiring AAD credentials, a user delegation SAS ensures that only users authenticated through AAD can obtain a SAS token, thereby tightly controlling access to resources. This reduces the risk posed by shared account keys and allows for more granular control over access permissions. In contrast, access control lists manage the permissions of users or groups, Azure Key Vault primarily stores and manages sensitive information like keys, and log analytics support is used for monitoring and logging but does not directly pertain to access control or authentication. Therefore, AAD credentials in a user delegation SAS represent a significant advancement in security by leveraging existing organizational authentication structures.