但是，在管理身份访问的情况下如何执行此操作？如何选择用于生成SAS URL的密钥？
在托管身份访问的情况下，您不需要使用访问密钥。SAS URL将使用分配给托管身份的权限来生成SAS URL。您将生成的SAS URL称为User Delegation SAS。
下面是在具有读取权限的blob容器上生成用户委托sas令牌的伪代码。sas令牌的有效期为1小时。

var credentials = new ManagedIdentityCredential();
var blobServiceClient = new BlobServiceClient(new Uri("https://account.blob.core.windows.net", credentials));
var sasExpiry = DateTimeOffset.UtcNow.AddHours(1);
var userDelegationKey = await blobServiceClient.GetUserDelegationKeyAsync(null, sasExpiry, CancellationToken.None);
var containerClient = blobServiceClient.GetBlobContainerClient("containername");
var sasBuilder = new BlobSasBuilder()
{
    BlobContainerName = "containername",
    Resource = "c",
    ExpiresOn = sasExpiry
};
sasBuilder.SetPermissions(BlobSasPermissions.Read);
var blobUriBuilder = new BlobUriBuilder(containerClient.Uri)
{
    Sas = sasBuilder.ToSasQueryParameters(userDelegationKey,
        blobServiceClient.AccountName)
};
return blobUriBuilder.ToUri();