BrainyBeeBrainyBee
ExploreBlogStart Studying
HomeMicrosoft Azure Administrator (AZ-104)Lab — Issue a signature you can actually revoke
Build Lab216 words

Lab — Issue a signature you can actually revoke

AZ-104 › Unit 2 › Lab

Lab — Issue a signature you can actually revoke

Lab brief

Node
AZ104-U2.T1
Time
25 minutes
Creates
A Standard_LRS storage account, a container, a stored access policy
Subscription
required
Difficulty
Core

The claim to make physical: a signature you issued without a stored access policy cannot be called back. You will issue one of each and try to revoke both.

These commands have not been run

There is no Azure subscription in the environment this lab was written in, so not one of these commands has been executed. The syntax is derived from Microsoft's own CLI documentation, and the elements this lab asserts are quoted from it at the bottom of the page — but the specific invocations, with these names in this order, are unrun. Read each command before you run it, and expect to adjust names and regions. Treat the teardown as part of the lab, not an optional extra.

Before you start

A subscription, and az login with an identity holding a data-plane role on the storage account — a user delegation SAS is authorized with your Entra credentials, not with the account key. One small LRS account for a few minutes costs pennies; the teardown removes it.

Walkthrough

Issue a signature you can actually revoke

  1. 1

    1. Create the account and a container

    Create a Standard_LRS account in a resource group you will delete afterwards, then a container in it. Keep it small — this is the only lab in the set that touches a billable resource at all.

Did it teach you what it was meant to?

Multiple choice · HardRevoking access

A partner's contract ends early and their service SAS has three weeks left. It was not issued against a stored access policy. What are your options?

Multiple choice · MediumSAS types

Why does step 2 require --auth-mode login where step 3 does not?

What goes wrong

What goes wrong

A user delegation SAS fails if your identity has no data-plane role on the account — Owner on the subscription is a control-plane role and is not enough by itself. Signatures are time-bounded, so a clock skew or a short expiry looks like a permissions failure. And if you regenerate the key in step 4, expect the signature from step 3 to stop working too; that is the lesson, not a mistake.

Tear it down

Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.

Teardown

  1. 1

    Delete the resource group

    az group delete --name bb-lab-storage. This is the one lab that leaves a billable resource behind if you skip the teardown, so do not skip it.

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.

Documentsha1
Create a user delegation SAS with Azure CLI477b8225fd48
Grant limited access to Azure Storage resources using SAS09e006bc7e1b
Create a stored access policyb3ae20db97dd
Manage storage account access keys950acf9dc800
Manage Azure resource groups by using Azure CLIa3840d837a3d
All Microsoft Azure Administrator (AZ-104) Study Resources

Related Notes

  • Lab — A lifecycle rule is a one-way door180 words
  • AZ-104 exam map391 words
  • Unit 1 roadmap — Manage Azure identities and governance358 words
  • Unit 1 capstone — Onboarding an acquired subsidiary810 words
  • Lab — A budget notifies and stops nothing166 words
  • Lab — Prove that inheritance only flows one way212 words
  • Lab — Tags do not inherit, and a lock is not a permission204 words
  • Lab — Watch a dynamic group fill itself in183 words
  • Cram sheet — Manage access to Azure resources447 words
  • Cram sheet — Manage Azure subscriptions and governance841 words
  • Cram sheet — Manage Microsoft Entra users and groups580 words
  • Unit 2 roadmap — Implement and manage storage375 words

Ready to study Microsoft Azure Administrator (AZ-104)?

Practice tests, flashcards, and all study notes — free, no sign-up.

Start Studying

Ready to study Microsoft Azure Administrator (AZ-104)?

Practice tests, flashcards, and all study notes — free, no sign-up needed.

Start Studying — Free
Microsoft Azure Administrator (AZ-104) ResourcesExplore All HivesBlogHome

© 2026 BrainyBee. Free AI-powered exam prep.