Microsoft Azure Administrator Associate AZ-104 Practice Question

They should create a Shared Access Signature (SAS) to grant the vendor temporary and restricted access to the storage resources. A SAS token allows specifying permissions, expiration time, and access to specific resources without sharing the storage account keys. Assigning an Azure Entra ID role would require the vendor to be part of the organization's Azure Entra ID tenant. Providing the storage account key would give full access to the storage account, compromising security. Configuring a virtual network service endpoint controls network access but does not grant the necessary permissions.