You manage an application that processes messages from an Azure Storage queue. Requirements: allow other applications access to the queue, be able to revoke access without regenerating storage account keys, and specify access at the queue level rather than the account level. Which SAS type meets these requirements?

A Service SAS with a stored access policy is the correct choice because it allows you to define permissions and an expiration time for a specific Azure Storage resource (like a queue) in a centralized policy. This policy can then be referenced by multiple Service SAS tokens. If you need to revoke access, you can simply disable or delete the stored access policy without regenerating the storage account keys, fulfilling the requirement. Account SAS grants access to all services within a storage account, which is too broad. User Delegation SAS is primarily for Blob storage and uses Azure AD credentials, not suitable for queue-level control in this scenario. A Service SAS with an ad hoc SAS does not allow for centralized revocation without regenerating the SAS itself or the account keys.