
Explanation:
1. For the blobs - a user delegation SAS only
To maximize security it's better to use a user delegation SAS:
From docs: As a security best practice, we recommend that you use Azure AD credentials when possible, rather than the account key, which can be more easily compromised. When your application design requires shared access signatures, use Azure AD credentials to create a user delegation SAS to help ensure better security.
This also prevents using shared keys & supports time-limited access. Note: user delegation SAS do not support stored access policies.
2. For the file shares - Azure AD credentials
It fulfills the requirement to maximize security (the most secure way recommended by Microsoft), but doesn't support time-limited access, which is optional and has lower priority than security.
https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas.