Configuring storage account authorization
To access data in the Blob or Files service, a client needs to be authenticated and authorized. Authentication verifies the identity of a client that is making the connection request while authorization grants or denies access to the identified client. Both the Azure Blob and Azure Files services support different authentication and authorization options, as shown in Figure 10.23. In general, the authorization options that are supported can be classified into two categories:
- Key-based authorization options such as a storage account key and shared access signature
- Identity-based authorization options such as Azure AD and on-premises AD
The best practice is to always implement identity-based authorization where possible as it provides better security and auditability:
Figure 10.23 – Azure Storage authentication options
Important note
The only exception to the authentication and authorization...
