You have an Azure subscription that contains a storage account named contoso?

No

No

No

In the given scenario, the storage account “contoso2023” has Allow storage account key access set to Disabled. This means that access keys and account-level Shared Access Signatures (SAS) cannot be used to authorize requests to the storage account. Only Azure AD authentication and user delegation SAS tokens are supported when key-based access is disabled.

Let’s analyze each user according to Azure’s documented storage access behavior:

User1 – User delegation SAS:

A user delegation SAS is based on Microsoft Entra (Azure AD) credentials and requires blob service (not file service).

Since the user delegation SAS can only access Blob storage, and the question specifies cont1 (Blob container), this would normally allow access if Azure AD permissions exist. However, if no RBAC permissions are granted, access is denied by default.

User2 – Service SAS:

A service SAS uses a storage account key to sign the token.

When Allow storage account key access is disabled, service SAS becomes invalid, because it relies on the account key.

Therefore, User2 cannot access blob or file data using a service SAS in this configuration.

User3 – Account SAS:

An account SAS is also generated using the storage account key.

With key access disabled, account SAS tokens are blocked, and any operation using them fails with an authorization error.

Thus, User3 cannot access the content either in the blob container or the file share.

According to Microsoft Azure Administrator Documentation:

“When you disable storage account key access, requests that use the account access keys for authorization fail. Shared access signatures (SAS) that are signed with an account key or a service SAS become invalid. Only user delegation SAS tokens, which use Azure AD credentials, are supported.”

This aligns with the behavior described in Azure Storage security documentation and AZ-104 study guides.