
Explanation:
Box 1: Yes
User1: User delegation SAS with maximum available permission
A user delegation SAS is secured with Microsoft Entra credentials and also by the permissions specified for the SAS. A user delegation SAS is supported for Blob Storage and Data Lake Storage, and can be used for calls to blob endpoints and dfs endpoints. It's not currently supported for Queue Storage, Table Storage, or Azure Files.
Box 2: No
User2: Service SAS with maximum available permission
A service SAS is secured with the storage account key.
However, we see that: Allow account key access is disabled.
Box 3: No
User3: Account SAS with maximum available permission
An account SAS is secured with the storage account key.
However, we see that: Allow account key access is disabled.
Reference:
https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview