Explanation: Box 1: Access Control (IAM) Since the App1 uses Managed Identity, App1 can access the Storage Account via IAM. As per requirement, we need to minimize the number of secrets used, so Access keys is not ideal. Box 2: Shared access signatures (SAS) We need temp access for App2, so we need to use SAS. Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-auth