Box 1: A shared access signature (SAS) token.
You can provide authorization credentials by using Azure Active Directory (AD), or by using a Shared Access Signature (SAS) token.
For Blob storage you can use Azure AD & SAS.
Note: In the current release, if you plan to copy blobs between storage accounts, you'll have to append a SAS token to each source URL. You can omit the SAS token only from the destination URL.
Box 2: A shared access signature (SAS) token.
For File storage you can only use SAS.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10