Shared access signature (SAS)
What it is
A shared access signature (SAS) is a signed token added to an Azure Storage URL. It delegates a limited set of permissions to a client for a limited time. It can say, for example, “this browser may upload one receipt to this container until 15:00 UTC.” Whoever possesses a valid SAS can use the permissions encoded in it.
Why it exists
An app can let a client transfer data directly to Azure Storage without giving that client a storage-account key or routing every byte through the app’s own servers. The SAS narrows access by resource, allowed operation, and expiry.
Key ideas
- A user delegation SAS uses Microsoft Entra credentials and is Microsoft’s preferred SAS type when supported.
- A service SAS delegates access to one Azure Storage service and is signed with a storage-account key. An account SAS can span services and is broader; both carry the risk of key-based authorization.
- A SAS is a bearer token. Treat it like a short-lived password: use HTTPS, grant the minimum scope and permission, set a short expiry, and never place it in source control or broad logs.
- A SAS does not replace normal identity design. Use a workload identity and RBAC where possible; use SAS when direct, time-limited delegated data access is actually needed.
Northwind example
Northwind’s web app authenticates a shopper, checks that the shopper may upload a receipt for their order, then creates a short-lived, write-only SAS for that single blob location. The browser uploads directly to Blob Storage. The SAS does not let the browser list every receipt, delete other receipts, or access storage after it expires.
Common confusion
- A SAS is not an Azure user, role assignment, or storage account key. It is a signed delegation based on an underlying identity or key.
- Expiry limits exposure but does not revoke a leaked token immediately. Have a revocation and incident-response plan.
- A SAS that allows write access does not validate the file’s business content. Validate uploaded data before using it.
Related
storage-account · blob-storage · storage-access-keys · rbac · managed-identity · northwind-traders-case-study
Sources and re-audit
- Microsoft Learn — Grant limited access with shared access signatures, checked 2026-09-16.