After migrating App1 to Azure, you must enforce controls to prevent unauthorized modification of stored data in order to satisfy security and compliance requirements. Which action should you take?

Creating an access policy for the blob service (specifically, a stored access policy) allows you to define permissions and an optional expiry for a shared access signature (SAS). This provides granular control over who can access and modify data in your Azure Storage account, fulfilling the requirement to prevent unauthorized modification. Implementing Azure resource locks prevents accidental deletion or modification of Azure resources themselves, not the data within a storage account. Creating Azure RBAC assignments controls who can manage the Azure resources, not necessarily who can access the data within those resources. Modifying the access level of the blob service (e.g., public or private) is a broader setting and doesn't offer the fine-grained control needed to prevent unauthorized modification by specific users or applications while still allowing authorized access.