Microsoft Azure Administrator Associate AZ-104 Practice Question

By generating shared access signatures (SAS) tied to a stored access policy, you can provide time-limited access to external users and have the ability to revoke their access by modifying or deleting the stored access policy without impacting the storage account keys or other users. Ad-hoc SAS tokens cannot be easily revoked; revoking them requires waiting for them to expire or regenerating the storage account keys, which can disrupt other services and users relying on those keys. Setting the container's public access level to 'Blob' would make the blobs publicly accessible to anyone via their URL, which does not meet the requirement for controlled access for specific users. Enabling anonymous access on the storage account is a prerequisite to allow public container access, but it does not by itself grant access or provide the granular, revocable, and user-specific controls required by the scenario.