AZ-204 Certification Practice Question #136

Question

You develop a REST API. You implement a user delegation SAS token to communicate with Azure Blob storage.
The token is compromised.
You need to revoke the token.
What are two possible ways to achieve this goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

A user delegation SAS is signed with a user delegation key derived from Azure AD credentials, not the storage account key. Therefore regenerating the account key (C) has no effect. Stored access policies (B) are not supported for user delegation SAS. The MS documentation is unambiguous: revocation happens either by (A) revoking the user delegation key itself (invalidates all tokens created from it) or (D) removing the RBAC role assignment for the security principal that was used to obtain the delegation key (prevents future keys and can be used to revoke existing ones when combined with key expiry). This matches the Most Voted community consensus of A + D.

More AZ-204 practice questions