title: User delegation key vs account key - security?
body: <p>In Microsoft's documentation for user delegation key, it says:</p>
  <blockquote>
  <p>A SAS token for access to a container, directory, or blob may be
  secured by using either Azure AD credentials or an account key. A SAS
  secured with Azure AD credentials is called a user delegation SAS.
  Microsoft recommends that you use Azure AD credentials when possible
  as a security best practice, rather than using the account key, which
  can be more easily compromised. When your application design requires
  shared access signatures, use Azure AD credentials to create a user
  delegation SAS for superior security.</p>
  </blockquote>
  <p>Why do this approach give &quot;superior security&quot;? I guess the SAS tokens are both safe? So why exactly is one approach safer than the other? If you use Stored Access Policy, you can also revoke SAS tokens when they have been issues with account keys.</p>