You manage an Azure Machine Learning Workspace named Workspase1 and an Azure Files share named Share1. You plan to create an Azure Files datastore in Workspace1 to target Share1. You need to…

Using the primary access key directly for datastore creation grants full control over the storage account and is generally not recommended for long-term or shared access due to significant security risks.

Anonymous access is not supported for Azure Files shares, meaning files cannot be accessed without some form of authentication.

An Account SAS (Shared Access Signature) key provides delegated access to resources in your storage account with customizable permissions and an expiry date. By setting a very long expiry or renewing it, it can provide practical 'permanent' access without exposing the storage account's primary key, which is a security best practice.

A User delegation SAS key is typically issued by Azure Active Directory for Blob storage, not Azure Files, and it still has a defined validity period, making it less 'permanent' than a long-lived Account SAS.