Storage account controls: shared key vs SAS revocation vs immutability vs locks

This sheet compares Disallow Shared Key, User delegation SAS, Stored access policy, Immutable storage, Resource lock.

Criterion	Disallow Shared Key	User delegation SAS	Stored access policy	Immutable storage	Resource lock
Purpose	Force all blob access through Entra ID	Least-privilege, short-lived external access	Revocable, individually killable SAS	WORM retention against modify and delete	Prevent the account resource being deleted

The verdict, the full comparison, 6 rules and 4 traps are part of SC-500 access. Unlock SC-500.