Exam AZ-104 topic 2 question 86 discussion

First: Azure AD & SAS Second: SAS Source: https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10#authorize-azcopy

Currently supported method of authorization Blob storage: Microsoft Entra ID & SAS Blob storage (hierarchical namespace): Microsoft Entra ID & SAS File storage: SAS only

For Azure Blob storage, AzCopy supports two authentication methods: Azure AD Authentication: Azure Active Directory (Azure AD) allows you to use your organizational credentials to authenticate and authorize access to Azure Blob storage. This method is secure and integrates with your organization's identity management. You can use Azure AD to grant permissions to users, groups, or service principals. Shared Access Signatures (SAS): SAS tokens provide a way to grant limited access to your Azure Blob storage without sharing your account key. You can specify the permissions, start time, expiry time, and IP range for the SAS token. For Azure File storage, AzCopy primarily supports: Shared Access Signatures (SAS): Similar to Blob storage, SAS tokens allow you to grant limited access to your Azure File storage. You can define the permissions, start time, expiry time, and IP range for the SAS token.

As of February 2025, according to the latest official Microsoft documentation, AzCopy supports the following authentication methods for Azure Blob Storage and Azure File Storage: 1. Azure Blob Storage: Supported Authentication Methods: Microsoft Entra ID (formerly Azure Active Directory or Azure AD): Allows for secure, role-based access control. Shared Access Signature (SAS) Tokens: Provide time-limited and permission-specific access. 2. Azure File Storage: Supported Authentication Methods: Microsoft Entra ID: Enables secure access with role-based permissions. Storage Account Key: Utilizes the account key for authentication. SAS Tokens are not supported for Azure File Storage with AzCopy. https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-files

https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-files "The examples in this article show the use of a SAS token to authorize access. However, for commands that target files and directories, you can now provide authorization credentials by using Microsoft Entra ID and omit the SAS token from those commands. You'll still have to use a SAS token in any command that targets only the file share or the account (For example: 'azcopy make https://mystorageaccount.file.core.windows.net/myfileshare' or 'azcopy copy 'https://mystorageaccount.file.core.windows.net'." So because the question doesn't talk about specific file or folder the answer provided is correct: 1) AD & SAS 2) ONLY SAS

this kind of questions are tricky, because it is not explicit if it is going to copy only some fiiles or the entire share. The examples in this article show the use of a SAS token to authorize access. However, for commands that target files and directories, you can now provide authorization credentials by using Microsoft Entra ID and omit the SAS token from those commands. You'll still have to use a SAS token in any command that targets only the file share or the account.

The answer is incorrect now because File storage supports Microsoft Entra ID after 11 Jun 2024. The correct answer is SAS and Microsoft Entra ID for both blob storage and file storage. There is a registration process to follow to use MS Entra ID for File with AzCopy. https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory

The answer is incorrect now because File storage supports Microsoft Entra ID after 6/12/2024. The correct answer is SAS and Microsoft Entra ID for both blob storage and file storage. There is a registration process to follow to use MS Entra ID for File with AzCopy. https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory

CORRECT

It can be authorized with credentials for FileShare as well.. The examples in this article show the use of a SAS token to authorize access. However, for commands that target files and directories, you can now provide authorization credentials by using Microsoft Entra ID and omit the SAS token from those commands. You'll still have to use a SAS token in any command that targets only the file share or the account (For example: 'azcopy make https://mystorageaccount.file.core.windows.net/myfileshare' or 'azcopy copy 'https://mystorageaccount.file.core.windows.net'.

Final Answer: First: Azure AD & SAS Second: SAS

Validated by ChatGPT 4 - Blob Storage: Azure AD and Shared Access Signatures (SAS) File Storage: Shared Access Signatures (SAS) only

for commands that target files and directories, you can now provide authorization credentials by using Microsoft Entra ID and omit the SAS token from those commands. You'll still have to use a SAS token in any command that targets only the file share or the account

Correct

Entra ID is now available to authorize Azcopy on Azure file share.

https://learn.microsoft.com/fr-fr/azure/storage/common/storage-ref-azcopy-copy

This link: https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory clearly states: "You can provide AzCopy with authorization credentials by using Microsoft Entra ID. That way, you won't have to append a shared access signature (SAS) token to each command." The question is kind of confusing - "which SHOULD you use". You COULD use both, but I am assuming Microsoft Entra ID (Azure AD) SHOULD be the right way for both.