You have an Azure Blob storage account named storage1 and an Azure Synapse Analytics serverless SQL poo1 named Pool1. From Pool1, you plan to run ad-hoc queries that target storage1. You need to ensur

A stored access policy defines reusable constraints for SAS tokens at the storage account level but is not a Synapse SQL object and cannot be referenced directly by OPENROWSET for authorization.

A server-level credential applies to all databases on the server and is used for different scenarios such as managed identity authentication; it does not support SAS-based authorization for OPENROWSET without a data source.

A managed identity uses Azure AD-based authentication rather than SAS tokens and represents a different authorization mechanism entirely.

A database-scoped credential stores the SAS token at the database level in the serverless SQL pool. When a query targets a storage path without an explicit data source, Synapse serverless SQL automatically matches the storage URL against existing database-scoped credentials to apply the correct authorization, eliminating the need to define a separate external data source.