Explanation:
Box 1: Account shared access signature (SAS)
Azure Storage blobs
Limit access to the blobs to specific periods of time
Account SAS
An account SAS is secured with the storage account key. An account SAS delegates access to resources in one or more of the storage services. All of the operations available via a service or user delegation SAS are also available via an account SAS.
Box 2: Service shared access signature (SAS)
Azure Files shares
Support access to the shares by using the SMB protocol.
A shared access signature can take one of the following two forms:
* Ad hoc SAS. When you create an ad hoc SAS, the start time, expiry time, and permissions are specified in the SAS URI. Any type of SAS can be an ad hoc SAS.
*-> Service SAS with stored access policy. A stored access policy is defined on a resource container, which can be a blob container, table, queue, or file share. The stored access policy can be used to manage constraints for one or more service shared access signatures. When you associate a service SAS with a stored access policy, the SAS inherits the constraints--the start time, expiry time, and permissions--defined for the stored access policy.
Reference:
https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview