You publish time-limited download links for blobs to external partners. You must be able to revoke any issued links immediately if needed. The storage account must use encryption with customer-managed keys stored in Azure Key Vault. Which two actions should you take?

To meet the requirement of immediately revoking time-limited download links, issuing service SAS tokens tied to a stored access policy on the container is crucial. Stored access policies provide a centralized control point, allowing you to revoke all associated SAS tokens by deleting or modifying the policy without waiting for individual token expiry. Account SAS tokens cannot be revoked before their expiry, and user delegation SAS relies on Azure AD token expiry, which doesn't offer immediate revocation for specific links. For customer-managed encryption keys, you must enable this feature on the storage account, linking it to a Key Vault key and granting the storage account appropriate access to that key. Keeping Microsoft-managed keys does not meet the customer-managed key requirement.