edits

Author: pauljewellmsft

articles/storage/blobs/storage-blob-dotnet-get-started.md

@@ -58,9 +58,7 @@ To connect an application to Blob Storage, create an instance of the [BlobServic
 
 To learn more about creating and managing client objects, see [Create and manage client objects that interact with data resources](storage-blob-client-management.md).
 
-You can authorize a `BlobServiceClient` object by using a Microsoft Entra authorization token, an account access key, or a shared access signature (SAS).
-
-To learn more about each of these authorization mechanisms, see [Authorize access to data in Azure Storage](../common/authorize-data-access.md).
+You can authorize a `BlobServiceClient` object by using a Microsoft Entra authorization token, an account access key, or a shared access signature (SAS). For optimal security, Microsoft recommends using Microsoft Entra ID with managed identities to authorize requests against blob data. For more information, see [Authorize access to Azure Storage data with Azure Active Directory](/azure/storage/common/storage-auth-aad.md).
 
 <a name='azure-ad'></a>
 

articles/storage/blobs/storage-blob-java-get-started.md

@@ -120,7 +120,7 @@ To connect an application to Blob Storage, create an instance of the [BlobServic
 
 To learn more about creating and managing client objects, see [Create and manage client objects that interact with data resources](storage-blob-client-management.md).
 
-You can authorize a `BlobServiceClient` object by using a Microsoft Entra authorization token, an account access key, or a shared access signature (SAS).
+You can authorize a `BlobServiceClient` object by using a Microsoft Entra authorization token, an account access key, or a shared access signature (SAS). For optimal security, Microsoft recommends using Microsoft Entra ID with managed identities to authorize requests against blob data. For more information, see [Authorize access to Azure Storage data with Azure Active Directory](/azure/storage/common/storage-auth-aad.md).
 
 <a name='azure-ad-recommended'></a>
 

articles/storage/blobs/storage-blob-javascript-get-started.md

@@ -110,7 +110,7 @@ Each type of resource is represented by one or more associated JavaScript client
 
 The [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) object is the top object in the SDK. This client allows you to manipulate the service, containers and blobs.
 
-## [Passwordless](#tab/azure-ad)
+## [Microsoft Entra ID (recommended)](#tab/azure-ad)
 
 Once your Azure storage account identity roles and your local environment are set up, create a JavaScript file which includes the [``@azure/identity``](https://www.npmjs.com/package/@azure/identity) package. Create a credential, such as the [DefaultAzureCredential](/javascript/api/overview/azure/identity-readme#defaultazurecredential), to implement passwordless connections to Blob Storage. Use that credential to authenticate with a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) object.
 
@@ -167,7 +167,7 @@ Create the [ContainerClient](/javascript/api/@azure/storage-blob/containerclient
 
 ### Create ContainerClient directly
 
-#### [Passwordless](#tab/azure-ad)
+#### [Microsoft Entra ID (recommended)](#tab/azure-ad)
 
 :::code language="javascript" source="~/azure_storage-snippets/blobs/howto/JavaScript/NodeJS-v12/dev-guide/create-container-client-with-default-azure-credential.js" highlight="27-30":::
 
@@ -206,7 +206,7 @@ List of Blob clients:
 
 ### Create BlobClient directly
 
-#### [Passwordless](#tab/azure-ad)
+#### [Microsoft Entra ID (recommended)](#tab/azure-ad)
 
 :::code language="javascript" source="~/azure_storage-snippets/blobs/howto/JavaScript/NodeJS-v12/dev-guide/create-blob-client-with-default-azure-credential.js" highlight="28-31":::
 

articles/storage/blobs/storage-blob-python-get-started.md

@@ -89,7 +89,7 @@ To connect an application to Blob Storage, create an instance of the [BlobServic
 
 To learn more about creating and managing client objects, including best practices, see [Create and manage client objects that interact with data resources](storage-blob-client-management.md).
 
-You can authorize a `BlobServiceClient` object by using a Microsoft Entra authorization token, an account access key, or a shared access signature (SAS).
+You can authorize a `BlobServiceClient` object by using a Microsoft Entra authorization token, an account access key, or a shared access signature (SAS). For optimal security, Microsoft recommends using Microsoft Entra ID with managed identities to authorize requests against blob data. For more information, see [Authorize access to Azure Storage data with Azure Active Directory](/azure/storage/common/storage-auth-aad.md).
 
 <a name='azure-ad'></a>
 

articles/storage/blobs/storage-blob-typescript-get-started.md

@@ -166,7 +166,7 @@ Create the [ContainerClient](/javascript/api/@azure/storage-blob/containerclient
 
 ### Create ContainerClient directly
 
-#### [Passwordless](#tab/azure-ad)
+#### [Microsoft Entra ID (recommended)](#tab/azure-ad)
 
 :::code language="typescript" source="~/azure_storage-snippets/blobs/howto/TypeScript/NodeJS-v12/dev-guide/src/auth-container-client-from-default-azure-credential.ts" :::
 
@@ -206,7 +206,7 @@ List of Blob clients:
 
 ### Create BlobClient directly
 
-#### [Passwordless](#tab/azure-ad)
+#### [Microsoft Entra ID (recommended)](#tab/azure-ad)
 
 :::code language="typescript" source="~/azure_storage-snippets/blobs/howto/TypeScript/NodeJS-v12/dev-guide/src/auth-blob-client-from-default-azure-credential.ts" :::