In Azure, a storage account access key provides full access to all data within the account. To reduce risk and follow security best practices, these keys should be rotated (regenerated) periodically.
According to the Microsoft Azure Storage and Security documentation, Azure Key Vault can be used to automate access key rotation for storage accounts.
Azure Key Vault allows you to:
Store and manage secrets, keys, and certificates securely.
Integrate directly with Azure Storage to manage account keys and Shared Access Signatures (SAS).
Enable automated key rotation when using Azure Key Vault managed storage account keys.
Here’s how it works:
In Azure Key Vault, add the storage account (storage1) as a managed storage account.
Key Vault periodically regenerates (rotates) the storage access keys automatically.
Applications can retrieve updated keys via Key Vault APIs or managed identities without manual key updates.
This process ensures consistent security and reduces the administrative effort required for key rotation.
Other options such as backup vaults, redundancy, or lifecycle management do not handle access key rotation—they serve data protection or retention purposes, not key management.
✅ Final Verified Answer: D. an Azure key vault
