Stored Access Policy
What it is
A stored access policy is a named rule on a blob container, table, queue, or file share. A service SAS can refer to that rule instead of carrying its own permissions, start time, and expiry time. Think of it as a centrally held set of rules that several service SAS URLs can share.
Why it exists
An ad hoc SAS has its constraints embedded in the URL, so it is hard to change after distribution. A stored access policy gives a service SAS an administrative control point: changing or deleting the policy changes what the linked SAS can do. That is useful for a group of long-lived service SAS URLs, but it is not a feature of every SAS type.
Key ideas
- Service SAS only — user delegation SAS and account SAS cannot use a stored access policy.
- The policy controls permissions, start time, and expiry. A SAS can still carry constraints such as an allowed IP address or protocol.
- Deletion or change is a broad action. It affects every service SAS that references that policy. Give each purpose its own policy when you need independent control.
- There is a limit of five policies per container, table, queue, or file share.
- Allow for propagation. A policy change can take up to 30 seconds to take effect; do not use it as an instant emergency switch without testing the response plan.
Northwind example
Northwind gives a partner read-only service SAS URLs for the monthly-reports container. Rather than create a separate permanent rule in each URL, Maya links them to the partner-reports stored access policy. When the contract ends, she removes that policy; the linked URLs stop being authorized after the change propagates. A customer upload URL using a user delegation SAS cannot use this policy and instead relies on its short expiry.
How it fits (diagram)
Exam notes
- Stored access policy = centrally managed constraints for a service SAS.
- It applies to a container, table, queue, or file share, not to account or user delegation SAS.
- It can revoke linked service SAS, but allow for propagation and its shared effect.
Related
sas-token · storage-access-keys · storage-account · azure-queues