Exam AZ-104 topic 2 question 86 discussion

First: Azure AD & SAS Second: SAS Source: https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10#authorize-azcopy

Currently supported method of authorization Blob storage: Microsoft Entra ID & SAS Blob storage (hierarchical namespace): Microsoft Entra ID & SAS File storage: SAS only

As of February 2025, according to the latest official Microsoft documentation, AzCopy supports the following authentication methods for Azure Blob Storage and Azure File Storage: 1. Azure Blob Storage: Supported Authentication Methods: Microsoft Entra ID (formerly Azure Active Directory or Azure AD): Allows for secure, role-based access control. Shared Access Signature (SAS) Tokens: Provide time-limited and permission-specific access. 2. Azure File Storage: Supported Authentication Methods: Microsoft Entra ID: Enables secure access with role-based permissions. Storage Account Key: Utilizes the account key for authentication. SAS Tokens are not supported for Azure File Storage with AzCopy. https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-files

https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-files "The examples in this article show the use of a SAS token to authorize access. However, for commands that target files and directories, you can now provide authorization credentials by using Microsoft Entra ID and omit the SAS token from those commands. You'll still have to use a SAS token in any command that targets only the file share or the account (For example: 'azcopy make https://mystorageaccount.file.core.windows.net/myfileshare' or 'azcopy copy 'https://mystorageaccount.file.core.windows.net'." So because the question doesn't talk about specific file or folder the answer provided is correct: 1) AD & SAS 2) ONLY SAS

this kind of questions are tricky, because it is not explicit if it is going to copy only some fiiles or the entire share. The examples in this article show the use of a SAS token to authorize access. However, for commands that target files and directories, you can now provide authorization credentials by using Microsoft Entra ID and omit the SAS token from those commands. You'll still have to use a SAS token in any command that targets only the file share or the account.

The answer is incorrect now because File storage supports Microsoft Entra ID after 11 Jun 2024. The correct answer is SAS and Microsoft Entra ID for both blob storage and file storage. There is a registration process to follow to use MS Entra ID for File with AzCopy. https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory

The answer is incorrect now because File storage supports Microsoft Entra ID after 6/12/2024. The correct answer is SAS and Microsoft Entra ID for both blob storage and file storage. There is a registration process to follow to use MS Entra ID for File with AzCopy. https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory

CORRECT

It can be authorized with credentials for FileShare as well.. The examples in this article show the use of a SAS token to authorize access. However, for commands that target files and directories, you can now provide authorization credentials by using Microsoft Entra ID and omit the SAS token from those commands. You'll still have to use a SAS token in any command that targets only the file share or the account (For example: 'azcopy make https://mystorageaccount.file.core.windows.net/myfileshare' or 'azcopy copy 'https://mystorageaccount.file.core.windows.net'.

Final Answer: First: Azure AD & SAS Second: SAS

Validated by ChatGPT 4 - Blob Storage: Azure AD and Shared Access Signatures (SAS) File Storage: Shared Access Signatures (SAS) only

for commands that target files and directories, you can now provide authorization credentials by using Microsoft Entra ID and omit the SAS token from those commands. You'll still have to use a SAS token in any command that targets only the file share or the account

Correct

Entra ID is now available to authorize Azcopy on Azure file share.

https://learn.microsoft.com/fr-fr/azure/storage/common/storage-ref-azcopy-copy

This link: https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory clearly states: "You can provide AzCopy with authorization credentials by using Microsoft Entra ID. That way, you won't have to append a shared access signature (SAS) token to each command." The question is kind of confusing - "which SHOULD you use". You COULD use both, but I am assuming Microsoft Entra ID (Azure AD) SHOULD be the right way for both.

Authorize access to blobs and files with AzCopy and Microsoft Entra ID https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory Both Blob and File storage can be authenticated with Entra ID and SAS