Microsoft Azure Administrator Associate AZ-104 Practice Question

By creating a shared access signature (SAS) associated with a stored access policy on the container, you can grant the vendor temporary access and retain the ability to revoke that access by modifying or deleting the policy. This approach doesn't require regenerating storage account keys and doesn't affect other services. Generating a SAS token without a stored access policy doesn't allow you to revoke access until it expires. Adding the vendor as a contributor provides broader access than necessary and complicates permissions management. Sharing the storage account access keys grants full access to the account, which is a security risk and revoking access would impact all services using those keys.