FREE STUDY NOTES · SC-500

Choosing a storage authorisation method: keys, SAS types and Microsoft Entra ID

Account keys, account and service SAS, user delegation SAS and Entra RBAC compared by scope and revocability.

From Ultra Transcenders SC-500 by Tony Rough (publishing soon)

Once a request reaches the account, it must be authorised. Each method differs in which services it works with, how narrowly it can be scoped and whether it expires. Figure 5.1 ranks the methods from the broadest and least revocable to the most controlled.

A ladder of five storage authorisation methods: account key, account SAS, service SAS, user delegation SAS, and Microsoft Entra ID with RBAC data roles. For each it shows what signs or authorises it and what limits it. Dashed boxes mark the methods that rely on the account key, which regenerating both keys invalidates. — Figure 5.1: Storage authorisation methods, from the broadest and least revocable to the most controlled

Method	Blob / Table	Azure Files SMB	Scope and lifetime
Shared Key (account key)	Yes	Yes (mount uses NTLMv2)	Full access to every service in the account, never expires
SAS	Yes	No	Chosen permissions, resources, start and expiry
Microsoft Entra ID OAuth (RBAC)	Yes	No (REST only)	Standing permissions, no built-in expiry
Kerberos (AD DS, Microsoft Entra Domain Services, Microsoft Entra Kerberos)	No	Yes	Identity-based SMB
Anonymous public access	Blob read only	No	Everyone

For scoped, expiring access by an external party, use a SAS; managed identities only exist for Azure resources you own, and RBAC has no time window.
SMB clients authenticate with a Kerberos ticket; OAuth 2.0/JWT tokens are for REST (blob data, Azure Files over REST); SAML is web SSO, never SMB.
Azure Storage Explorer connects to blob containers and file shares with a SAS URL (SAS works over the REST API). Robocopy and Windows File Explorer reach Azure Files only by mounting over SMB (account key or identity auth, no SAS) and cannot access blob containers.

Get the whole book

This note is one section of Ultra Transcenders SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

Amazon.co.ukKindle: coming soonPaperback: coming soon

Amazon.comKindle: coming soonPaperback: coming soon

Publishing soon on Amazon in Kindle and paperback editions.

About the book · Free SC-500 glossary · All SC-500 study notes

More SC-500 study notes

Privileged Identity Management: eligible vs active assignments and role settings
How PIM activation, approval, maximum duration and notifications work, and what each role setting controls.
Conditional Access policies: assignments, conditions and grant controls
How a Conditional Access policy is built and how multiple policies combine.
Key Vault access: control plane vs data plane, RBAC vs access policies
Why control-plane roles can't read secrets, and which Key Vault role or access policy each task needs.
Azure Policy effects and remediation tasks
What Deny, Audit, Append, Modify and DeployIfNotExists do, and when you need a remediation task and managed identity.
Always Encrypted, TDE and dynamic data masking compared
Where each Azure SQL data protection feature works and who it protects data from.
Azure Virtual Network Manager security admin rules and NSGs
How security admin rules are evaluated before NSGs, and when to use Allow, Deny or Always allow.
Just-in-time VM access in Defender for Cloud
How JIT locks management ports and opens them on request, with the plan and permissions it needs.