You have an Azure Storage account named storage1 that hosts a blob container used by...

A user delegation SAS is the best choice because the requirement specifically calls for time-bound, least-privilege access to Azure Blob Storage. A SAS can be restricted to the exact resource, permissions, and validity period required. For example, the token can grant only the permissions needed to upload blobs and can be configured with a defined expiration time. Microsoft recommends using a user delegation SAS whenever possible because it is secured with Microsoft Entra credentials instead of the storage account key. Microsoft Learn

This is more secure than Shared Key authorization, which relies on storage account keys that provide broad access and are harder to constrain safely. Microsoft explicitly recommends avoiding Shared Key when more secure Microsoft Entra-based approaches are available. Microsoft Learn

A managed identity would be ideal for a workload hosted on an Azure service that supports managed identities, but the question describes a third-party workflow system and emphasizes temporary delegated access. A user delegation SAS directly satisfies that use case. Anonymous public access is inappropriate because it does not provide controlled authenticated upload access.

Therefore, the correct authorization mechanism is a user delegation SAS.