Storage Access Authorization Methods Matrix

Traditionally, access to Azure Storage is granted using account access keys or Shared Access Signature (SAS) tokens. An account key grants full control over the entire storage account to anyone who has it, which is a major security risk if the key is leaked. SAS tokens are an improvement because they can be scoped to specific resources and have an expiration time, but they are not tied to a user's identity. This means if a SAS token is stolen, it can be used by anyone until it expires, and managing the creation and lifecycle of many SAS tokens adds operational complexity.