A development team is building a REST API that stores data in Azure Blob Storage and will be deployed to Azure App Service. Developers need access to the storage account for two months only, and must not have access after that period. How should you grant the developers temporary access?

Generating a Shared Access Signature (SAS) is the correct approach because it allows you to grant time-limited access to specific Azure Storage resources. You can define the start and expiry times (e.g., two months), permissions (read, write, list), and the resources accessible (e.g., a specific container or blob). Once the SAS expires, developers automatically lose access without any manual intervention. Lifecycle management policies are for managing blob tiers and deletion based on rules, not for granting temporary access to users. Providing storage account access keys grants full, perpetual access, which is insecure and doesn't meet the temporary access requirement. Assigning RBAC roles grants persistent access based on the role definition and requires manual removal, which is less efficient for temporary access than an expiring SAS.