An application needs temporary read access to one blob. The team wants delegated access signed using Entra credentials rather than the account key. Which mechanism should it use?

1. The storage account's primary access key
2. A user delegation SAS scoped to the blob
3. A permanent anonymous container setting
4. Subscription Contributor alone