Is Shared Access Signature mandatory on a container-level or blob-level? Or can I generate SAS tokens without enabling Shared Access Signature?

In what scenarios should container-level or blob-level SAS tokens be used instead of Storage Account Access Keys?

In what scenarios should Storage Account Access Keys be used instead of container-level or blob-level SAS tokens?

What best practices should be followed when generating and sharing SAS tokens?

How does Azure AD authentication differ from using access keys for blob access?